CVE-2026-6497 Details
Description
A vulnerability was determined in prasathmani TinyFileManager up to 2.6. Affected by this vulnerability is an unknown functionality of the file /filemanager.php?p= ajax=true&type=upload of the component File Upload Handler. This manipulation of the argument uploadurl causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
A server-side request forgery (SSRF) vulnerability has been identified in Tiny File Manager versions up to 2.6. The issue arises in the file upload feature within 'filemanager.php', specifically when the 'uploadurl' parameter is manipulated. This vulnerability allows authenticated attackers to bypass the IP blocklist and make the server send HTTP requests to internal resources, including localhost services and cloud metadata endpoints.
It is recommended to resolve the hostname to an IP address before comparison, blocking all private or reserved ranges using IP range checks instead of regex. If the URL upload feature is not needed, it can be disabled entirely.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 17, 2026CISA-ADP
Assessed Apr 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://drive.google.com/file/d/1pB3dI4oUy09mAtDHWbLlcoRRC1b3YU6k/view?usp=sharing | [email protected] | ExploitPartial ContentRemedy |
| https://vuldb.com/submit/787943 | [email protected] | Technical Description |
| https://vuldb.com/vuln/358040 | [email protected] | AdvisoryExploitPartial Content |
| https://vuldb.com/vuln/358040/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| prasathmani TinyFileManager | <= 2.6 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 17, 2026 | New CVE Received | [email protected] |