PT-2019-14833 · Unknown · Tiny File Manager

Prasathmani · Published 2019-12-30 · Updated 2025-12-31 · CVE-2019-16790

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tiny File Manager versions prior to 2.3.9

Description The issue allows for remote code execution through the Upload from URL feature and the Edit/Rename files functionality. It affects only authenticated users.

Recommendations For versions prior to 2.3.9, update to version 2.3.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the Upload from URL and Edit/Rename files features for authenticated users until the update is applied.

Fix

RCE

Unrestricted File Upload

OS Command Injection

Weakness Enumeration

CWE-434

CWE-78

Related Identifiers

CVE-2019-16790

GHSA-W72H-V37J-RRWR

Affected Products

Tiny File Manager

References · 5

• https://github.com/prasathmani/tinyfilemanager/commit/9a499734c5084e3c2eb505f100d50baac1793bd8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-16790 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16790 · Vendor Advisory
• https://github.com/prasathmani/tinyfilemanager/security/advisories/GHSA-w72h-v37j-rrwr · Note
• https://t.me/cveNotify/147385 · Telegram Post