CVE-2021-40964

Katalog CVE

CVSS 6.5 · Medium EPSS 8,2%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada prasathmani tiny file manager. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

A Path Traversal vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload a file (with Admin credentials or with the CSRF vulnerability) with the "fullpath" parameter containing path traversal strings (../ and ..\) in order to escape the server's intended working directory and write malicious files onto any directory on the computer.

Rincian

Terbit di NVD

15 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

8,2% peluang dieksploitasi; lebih tinggi dari 94,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://packetstormsecurity.com/files/166330/Tiny-File-Manager-2.4.6-Shell-Upload.html exploit · advisory pihak ketiga · vdb entry
• https://gist.github.com/omriinbar/953368dcdd9e5eeefd83920166099528 advisory pihak ketiga
• https://github.com/prasathmani/tinyfilemanager product · advisory pihak ketiga