CVE-2026-108801: TinyFileManager Unrestricted Upload RCE Flaw

CVE-2026-108801 Overview

CVE-2026-108801 is an unrestricted file upload vulnerability in prasathmani TinyFileManager versions up to 2.6. The flaw resides in the move_uploaded_file function within tinyfilemanager.php. Attackers can manipulate the fullpath argument to upload arbitrary files to the server. Exploitation requires low-level privileges and can be performed remotely over the network. Public proof-of-concept code has been released, and the vendor did not respond to disclosure attempts. The weakness is classified under CWE-284: Improper Access Control.

Critical Impact

Authenticated remote attackers can upload arbitrary files to arbitrary paths through manipulation of the fullpath parameter, enabling potential code execution and file system tampering.

Affected Products

• prasathmani TinyFileManager versions up to and including 2.6
• The file tinyfilemanager.php containing the vulnerable move_uploaded_file function
• Web applications bundling TinyFileManager as a file management component

Discovery Timeline

• 2026-10-12 - CVE-2026-108801 published to NVD
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-108801

Vulnerability Analysis

The vulnerability stems from insufficient access control around file upload handling in tinyfilemanager.php. The move_uploaded_file function accepts a user-controlled fullpath argument without proper validation of the destination path or file type. An authenticated attacker can supply crafted values to place arbitrary content outside the intended upload directory. Because TinyFileManager is deployed as a web-accessible PHP file manager, uploaded files may be directly reachable through HTTP. This exposes affected hosts to webshell deployment, configuration overwrite, and lateral tampering with existing application files. See the VulDB Vulnerability Details for additional context.

Root Cause

The root cause is improper access control [CWE-284] on upload destination handling. The fullpath argument is trusted and passed to move_uploaded_file without constraints that bind writes to a safe directory or restrict executable file extensions. The absence of path canonicalization and allow-listing turns a legitimate upload feature into an arbitrary write primitive.

Attack Vector

The attack is remote and requires authenticated access with low privileges. An attacker issues a crafted multipart upload request to the TinyFileManager endpoint, setting fullpath to a target location such as the webroot. Because no interaction is needed beyond the attacker's own request, exploitation is scriptable. Public proof-of-concept code is available on GitHub Gist PoC Code, lowering the barrier to weaponization.

// No verified exploit code is reproduced here.
// Refer to the public PoC linked in the external references
// for the HTTP request structure used against tinyfilemanager.php.

Detection Methods for CVE-2026-108801

Indicators of Compromise

• Unexpected .php, .phtml, or .phar files appearing within TinyFileManager-managed directories or webroot locations
• HTTP POST requests to tinyfilemanager.php containing a fullpath parameter with traversal sequences such as ../ or absolute paths
• New or modified files owned by the web server user with timestamps correlating to upload activity
• Outbound connections from the web server shortly after an upload event, suggesting webshell execution

Detection Strategies

• Monitor web server access logs for POST requests to tinyfilemanager.php and alert on anomalous fullpath values
• Deploy file integrity monitoring on directories writable by TinyFileManager and on the application webroot
• Inspect uploaded files for PHP tags or obfuscated payloads before they are written to disk via a reverse proxy or WAF

Monitoring Recommendations

• Enable verbose logging on the PHP runtime to capture move_uploaded_file destinations and failures
• Correlate authentication events with upload activity to flag low-privilege accounts performing unusual file writes
• Baseline normal upload volumes and alert on deviation, particularly spikes outside business hours

How to Mitigate CVE-2026-108801

Immediate Actions Required

• Restrict network exposure of TinyFileManager by placing it behind VPN or IP allow-listing until a fix is available
• Rotate all TinyFileManager credentials and audit user accounts for unauthorized access
• Review the webroot and TinyFileManager storage paths for unexpected scripts and remove any webshells
• Disable PHP execution within TinyFileManager upload directories via web server configuration

Patch Information

The vendor was contacted but did not respond, and no official patch is referenced in the advisory. Monitor the prasathmani TinyFileManager repository for future updates. Consult the VulDB CVE Database Entry for status changes.

Workarounds

• Configure the web server to deny execution of PHP files inside directories writable by TinyFileManager, for example using Apache php_flag engine off or Nginx location blocks
• Enforce strict server-side validation that constrains uploads to a fixed base directory and rejects path traversal sequences
• Remove or disable TinyFileManager if file management functionality is not business-critical
• Place a web application firewall rule in front of tinyfilemanager.php that blocks requests containing fullpath values with ../ or absolute paths

# Nginx snippet to prevent PHP execution in a TinyFileManager uploads directory
location ^~ /uploads/ {
    location ~ \.(php|phtml|phar)$ {
        deny all;
        return 403;
    }
}