PT-2021-23019 · Unknown · Tiny File Manager

Published 2021-09-15 · Updated 2025-12-31 · CVE-2021-40964

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions TinyFileManager versions up to and including 2.4.6

Description A Path Traversal issue exists that allows attackers to upload a file with the fullpath parameter containing path traversal strings (../ and ..) to escape the server's intended working directory and write malicious files onto any directory on the computer. This can be done with Admin credentials or by exploiting the CSRF vulnerability.

Recommendations For versions up to and including 2.4.6, consider disabling the file upload feature until a patch is available to prevent exploitation of the Path Traversal vulnerability. Restrict access to the fullpath parameter to minimize the risk of writing malicious files to unintended directories.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-40964

Affected Products

Tiny File Manager

References · 9

• 🔥 http://packetstormsecurity.com/files/166330/Tiny-File-Manager-2.4.6-Shell-Upload.html · Exploit
• 🔥 https://exploit-db.com/exploits/50828 · Exploit
• https://osv.dev/vulnerability/CVE-2021-40964 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40964 · Security Note
• https://github.com/prasathmani/tinyfilemanager · Note
• https://t.me/cvenotify/21523 · Telegram Post
• https://t.me/cibsecurity/28945 · Telegram Post
• https://gist.github.com/omriinbar/953368dcdd9e5eeefd83920166099528 · Note
• https://t.me/cveNotify/147388 · Telegram Post