PT-2026-5900 · Unknown · Tiny File Manager

Published 2026-02-03 · Updated 2026-02-10 · CVE-2025-46651

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tiny File Manager versions through 2.6

Description The software contains a server-side request forgery (SSRF) issue in the URL upload feature. Insufficient validation of user-supplied URLs allows an attacker to send crafted requests to localhost, such as using http://www.127.0.0.1.example.com/. This could result in unauthorized port scanning or access to internal services.

Recommendations Update Tiny File Manager to a version later than 2.6.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-46651

Affected Products

Tiny File Manager

References · 7

• 🔥 https://github.com/RobertoLuzanilla/tinyfilemanager-security-advisories/blob/main/CVE-2025-46651.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-46651 · Security Note
• https://osv.dev/vulnerability/CVE-2025-46651 · Vendor Advisory
• https://github.com/prasathmani/tinyfilemanager/blob/master/tinyfilemanager.php#L608 · Note
• https://t.me/cveNotify/151004 · Telegram Post
• https://t.me/cveNotify/151631 · Telegram Post
• https://t.me/cveNotify/150872 · Telegram Post