PT-2019-14833 · Unknown · Tiny File Manager

Prasathmani · Publicado 2019-12-30 · Atualizado 2025-12-31 · CVE-2019-16790

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tiny File Manager versions prior to 2.3.9

Description The issue allows for remote code execution through the Upload from URL feature and the Edit/Rename files functionality. It affects only authenticated users.

Recommendations For versions prior to 2.3.9, update to version 2.3.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the Upload from URL and Edit/Rename files features for authenticated users until the update is applied.

Correção

RCE

Unrestricted File Upload

OS Command Injection

Enumeração de Fraquezas

CWE-434

CWE-78

Identificadores relacionados

CVE-2019-16790

GHSA-W72H-V37J-RRWR

Produtos afetados

Tiny File Manager

Referências · 5

• https://github.com/prasathmani/tinyfilemanager/commit/9a499734c5084e3c2eb505f100d50baac1793bd8 · Correção
• https://github.com/prasathmani/tinyfilemanager/security/advisories/GHSA-w72h-v37j-rrwr · Nota
• https://t.me/cveNotify/147385 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2019-16790 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-16790 · Aviso do Fabricante