PT-2020-13035 · Unknown · Tiny File Manager

Peefour · Published 2020-04-28 · Updated 2025-12-31 · CVE-2020-12103

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Tiny File Manager version 2.4.1

Description The issue allows authenticated users to create backup copies of files with a .bak extension outside the intended scope in the same directory where they are stored. This is due to a vulnerability in the ajax file backup copy functionality.

Recommendations For Tiny File Manager version 2.4.1, consider disabling the ajax file backup copy functionality until a patch is available to prevent exploitation. Restrict access to the backup copy feature to minimize the risk of unauthorized file creation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-12103

Affected Products

Tiny File Manager

References · 9

• 🔥 https://quantumleap.it/tiny-file-manager-path-traversal-recursive-directory-listing-and-absolute-path-file-backup-copy · Exploit
• https://osv.dev/vulnerability/CVE-2020-12103 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12103 · Security Note
• https://github.com/prasathmani/tinyfilemanager/issues/357 · Note
• https://github.com/prasathmani/tinyfilemanager/commit/a0c595a8e11e55a43eeaa68e1a3ce76365f29d06 · Note
• https://t.me/cveNotify/147387 · Telegram Post
• https://t.me/cvenotify/3362 · Telegram Post
• https://cyberaz0r.info/2020/04/tiny-file-manager-multiple-vulnerabilities · Note
• https://t.me/cvenotify/79770 · Telegram Post