CVE-2026-6496

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability was found in prasathmani TinyFileManager up to 2.6. Affected is an unknown function of the file /filemanager.php of the component POST Parameter Handler. The manipulation of the argument file[] results in path traversal. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Apr 17, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-649608.7ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, f CVE-2026-649616.3ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values req CVE-2026-649625.1ATutor is vulnerable to Cross-Site Request Forgery (CSRF) in profile update functionality. An attacker can craft a malicious website which, CVE-2026-649632.3A path traversal vulnerability in ATutor allows an authenticated user to access files from other course directories when the AT_FORCE_GET_FI CVE-2026-649646.3ATutor generates predictable email confirmation tokens due to the use of insufficiently random values in the account confirmation functional CVE-2026-649655.3ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-privileged authenticated user (e.g. a stud CVE-2026-649668.7ATutor is vulnerable to a Path Traversal vulnerability in ZIP extraction functionality. An attacker with instructor privileges can upload an CVE-2026-649676.9A path traversal vulnerability in ATutor's error log viewer allows an attacker with administrative privileges to access arbitrary files outs CVE-2026-649685.1ATutor is vulnerable to Server-Side request forgery in import functionalities. An authenticated administrator can make the server request ar CVE-2026-649695.3ATutor is vulnerable to Insecure Direct Object Reference (IDOR) attack in profile picture related endpoints. Any authenticated user, includi CVE-2026-64976.3A vulnerability was determined in prasathmani TinyFileManager up to 2.6. Affected by this vulnerability is an unknown functionality of the f CVE-2026-649705.1ATutor is vulnerable to Stored Cross Site Scripting in registration functionality. An attacker can register a new account and enter a JavaS