prasathmani TinyFileManager Path Traversal Vulnerability in tinyfilemanager.php

A path traversal vulnerability has been identified in prasathmani TinyFileManager versions through 2.6. The issue arises in the file tinyfilemanager.php, where the fullpath parameter can be manipulated to traverse directories. This vulnerability can be exploited remotely, and an exploit is publicly available.

Impact

Exploitation of this vulnerability allows for path traversal, which can lead to unauthorized access to files and directories outside the intended directory structure.

Reproduction

To reproduce this vulnerability, upload a file through the TinyFileManager interface, specifying a path in the fullpath parameter that includes directory traversal sequences. The application improperly validates the path, allowing the file to be uploaded to an arbitrary location on the server.