CVE-2026-6496 Details

A path traversal vulnerability exists in Prasathmani TinyFileManager versions up to 2.6. The issue arises in the filemanager.php component, specifically within the POST parameter handler. The vulnerability allows authenticated, non-read-only users to delete arbitrary files outside the application's root directory by manipulating the file[] POST parameter. The mass delete handler fails to properly sanitize input, enabling traversal sequences to escape the web root and target files in the /tmp directory.

The vulnerability can be addressed by applying the fm_clean_path() function to each entry in the file[] array before constructing the target path, ensuring consistent input sanitization as applied in other file operation handlers.