PT-2020-13034 · Unknown · Tiny File Manager

Peefour · Published 2020-04-28 · Updated 2025-12-31 · CVE-2020-12102

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tiny File Manager version 2.4.1

Description The issue allows authenticated users to enumerate directories and files on the filesystem outside of the application scope due to a Path Traversal vulnerability in the ajax recursive directory listing functionality.

Recommendations For Tiny File Manager version 2.4.1, consider disabling the ajax recursive directory listing functionality until a patch is available to prevent exploitation of the Path Traversal vulnerability.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-12102

Affected Products

Tiny File Manager

References · 9

• 🔥 https://quantumleap.it/tiny-file-manager-path-traversal-recursive-directory-listing-and-absolute-path-file-backup-copy · Exploit
• https://osv.dev/vulnerability/CVE-2020-12102 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12102 · Security Note
• https://github.com/prasathmani/tinyfilemanager/issues/357 · Note
• https://github.com/prasathmani/tinyfilemanager/commit/a0c595a8e11e55a43eeaa68e1a3ce76365f29d06 · Note
• https://t.me/cvenotify/3360 · Telegram Post
• https://t.me/cveNotify/147386 · Telegram Post
• https://t.me/cvenotify/79769 · Telegram Post
• https://cyberaz0r.info/2020/04/tiny-file-manager-multiple-vulnerabilities · Note