CVEvulnerability
CVE-2022-45476
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2022-11-25
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-434
Description
Tiny File Manager version 2.4.8 executes the code of files uploaded by users of the application, instead of just returning them for download. This is possible because the application is vulnerable to insecure file upload.
Affected configurations
• prasathmani tiny file manager 2.4.8
Related
Weakness · CWE (1)
- CWE-434 Unrestricted Upload of File with Dangerous Type weakness
References
- https://fluidattacks.com/advisories/mosey/ Exploit, Third Party Advisory
- https://github.com/prasathmani/tinyfilemanager/ Product
- https://fluidattacks.com/advisories/mosey/ Exploit, Third Party Advisory
- https://github.com/prasathmani/tinyfilemanager/ Product