Live › vulnerability › CVE-2026-116044
Go to dashboardTinyFileManager, a single-file PHP web file manager, has an unrestricted upload flaw in its Remote URL File Upload module in tinyfilemanager.php. A remote attacker can upload arbitrary files to the server, and a public exploit exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 06:36 UTC. All times on this page are UTC.
Teams running TinyFileManager up to version 2.6 on a PHP web server, especially where the file manager is reachable from the internet. The sources do not say whether authentication changes exposure. Teams not running TinyFileManager can skip it.
No product ranges from the sources yet.
tinyfilemanager.php is deployed and which version it is; the sources say versions up to 2.6 are affectedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security vulnerability has been detected in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of the file tinyfilemanager.php of the component Remote URL File Upload Module. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-116044")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.