CVE-2025-15138: falha de média gravidade em prasathmani TinyFileManager
prasathmani TinyFileManager tinyfilemanager.php path traversal
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.1epss 0.7%
A flaw has been found in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of the file tinyfilemanager.php. This manipulation of the argument fullpath causes path traversal. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
prasathmani · TinyFileManagerCVEs relacionadas — prasathmani TinyFileManager
No mesmo produto, das mais perigosas para as menos.
CVE-2026-6496MEDIUMprasathmani TinyFileManager POST Parameter filemanager.php path traversalEPSS 0.5%CVE-2026-6497MEDIUMprasathmani TinyFileManager File Upload filemanager.php server-side request forgeryEPSS 0.3%CVE-2026-108801MEDIUMprasathmani TinyFileManager tinyfilemanager.php move_uploaded_file unrestricted uploadEPSS 0.3%CVE-2026-116044MEDIUMprasathmani TinyFileManager Remote URL File Upload tinyfilemanager.php unrestricted uploadEPSS 0.2%