CVE-2026-116044
MEDIUM 5.3A security vulnerability has been detected in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of the file tinyfilemanager.php of the component Remote URL File Upload Module. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.2%chance of exploitation in 30 days · 10th percentile
Impact if exploited
5.3CVSS 4.0 · MEDIUM
- ConfidentialityLow
- IntegrityLow
- AvailabilityLow
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ⚠Privileges: Requires a low-privilege account
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
- ✓Requirements: No special attack requirements
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-434: Unrestricted Upload
- CWE-284: Improper Access Controls
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
References and research data (JSON)
All CVSS metrics
- MEDIUM 5.3 v4.0 · CNA Primary
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P - MEDIUM 6.3 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C - MEDIUM 6.3 v3.0 · CNA Primary
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C - MEDIUM 6.5 v2.0 · CNA Primary
AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C - LOW 2.1 v4.0 · NVD Secondary
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - MEDIUM 6.3 v3.1 · NVD Primary
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - MEDIUM 6.5 v2.0 · NVD Secondary
AV:N/AC:L/Au:S/C:P/I:P/A:P
References
Exploit-tagged references (not proof of a PoC)
- https://drive.google.com/file/d/1db5JeUDltknuzWMaFQB0cYYDVpmFWpl7/view CVE record · VulDB · Updated 2026-10-25T05:45:16.032Z
NVD · CVE-2026-116044 · Updated 2026-10-25T06:16:32.500
Advisories
- https://vuldb.com/cve/CVE-2026-116044 CVE record · VulDB · Updated 2026-10-25T05:45:16.032Z
NVD · CVE-2026-116044 · Updated 2026-10-25T06:16:32.500 - https://vuldb.com/submit/993761 CVE record · VulDB · Updated 2026-10-25T05:45:16.032Z
NVD · CVE-2026-116044 · Updated 2026-10-25T06:16:32.500 - https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-109338 EUVD · EUVD-2026-109338
Technical & other
- https://vuldb.com/vuln/426120 CVE record · VulDB · Updated 2026-10-25T05:45:16.032Z
NVD · CVE-2026-116044 · Updated 2026-10-25T06:16:32.500 - https://vuldb.com/vuln/426120/cti CVE record · VulDB · Updated 2026-10-25T05:45:16.032Z
NVD · CVE-2026-116044 · Updated 2026-10-25T06:16:32.500