PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-108801 prasathmani CVE debrief

A security flaw has been discovered in prasathmani TinyFileManager up to 2.6. The impacted element is the function move_uploaded_file of the file tinyfilemanager.php. Performing a manipulation of the argument fullpath results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Vendor
prasathmani
Product
TinyFileManager
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-12
Original CVE updated
2026-10-12
Advisory published
2026-10-12
Advisory updated
2026-10-12

Who should care

Defenders responsible for TinyFileManager instances, especially versions up to 2.6, should assess exposure and prioritize secure file upload and validation mechanisms. Security teams should monitor for suspicious file upload activity and implement compensating controls to detect and prevent exploitation.

Why it matters

The CVE-2026-108801 vulnerability in prasathmani TinyFileManager up to 2.6 allows for unrestricted file uploads, posing a security risk. Defenders should prioritize verifying exposure, assessing secure file upload mechanisms, monitoring for suspicious activity, and implementing compensating controls.

  • Verify exposure of TinyFileManager instances to unrestricted file upload
  • Assess implementation of secure file upload and validation mechanisms
  • Monitor for suspicious file upload activity
  • Implement compensating controls to detect and prevent exploitation

Technical summary

The vulnerability is located in the move_uploaded_file function of the tinyfilemanager.php file in prasathmani TinyFileManager up to 2.6. An attacker can manipulate the fullpath argument to upload files without restriction, leading to potential security risks. The attack can be carried out remotely, and an exploit has been released to the public. Defenders should prioritize verifying exposure of TinyFileManager instances, especially versions up to 2.6, and assess the implementation of secure file upload and validation mechanisms to mitigate potential impacts.

Defensive priority

Defenders should prioritize verifying exposure of TinyFileManager instances, especially versions up to 2.6, and assess the implementation of secure file upload and validation mechanisms.

Recommended defensive actions

  • Verify exposure of TinyFileManager instances, especially versions up to 2.6
  • Assess implementation of secure file upload and validation mechanisms
  • Monitor for suspicious file upload activity
  • Implement compensating controls, such as Web Application Firewalls (WAFs), to detect and prevent exploitation
  • Review vendor patch guidance for TinyFileManager
  • Conduct an exposure review of current deployments
  • Track changes to TinyFileManager through source tracking

Evidence notes

The CVE record and source item provide details on the vulnerability in TinyFileManager. However, the corpus does not establish specific versions beyond 2.6, exploitation, impact, or remediation, which require verification from the supplied official sources.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-108801 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-108801

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-108801 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-108801

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • prasathmani TinyFileManager tinyfilemanager.php move_uploaded_file unrestricted upload

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108801.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/416578

    Supplemental source - vdb-entry, technical-description

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/416578/cti

    Supplemental source - signature, permissions-required

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/cve/CVE-2026-108801

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/submit/962457

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://gist.github.com/stoic-crawler/db2649f1df9c4b8a231122eafc92fc9d

    Supplemental source - exploit

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.