Peefour

**Name of the Vulnerable Software and Affected Versions** Tiny File Manager version 2.4.1 **Description** The issue allows authenticated users to enumerate directories and files on the filesystem outside of the application scope due to a Path Traversal vulnerability in the ajax recursive directory listing functionality. **Recommendations** For Tiny File Manager version 2.4.1, consider disabling the ajax recursive directory listing functionality until a patch is available to prevent exploitation of the Path Traversal vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tiny File Manager version 2.4.1 **Description** The issue allows authenticated users to create backup copies of files with a .bak extension outside the intended scope in the same directory where they are stored. This is due to a vulnerability in the ajax file backup copy functionality. **Recommendations** For Tiny File Manager version 2.4.1, consider disabling the ajax file backup copy functionality until a patch is available to prevent exploitation. Restrict access to the backup copy feature to minimize the risk of unauthorized file creation.