CVE-2026-6496

A path traversal vulnerability exists in TinyFileManager versions up to 2.6, specifically in the POST Parameter Handler function of /filemanager.php. An authenticated attacker can manipulate the file[] argument to traverse directory structures and access unauthorized files on the affected system. This vulnerability affects organizations deploying this open-source file management application. The vulnerability has a CVSS 3.1 score of 5.4 (Medium severity) with a network-based attack vector requiring low complexity and valid user credentials. While the vulnerability does not compromise confidentiality, it enables integrity compromise and availability disruption through unauthorized file access and manipulation. The FAUCET Risk Score of 32.0/100 indicates moderate concern. Exploitation status is elevated due to public disclosure of the vulnerability and available proof-of-concept code, though formal CISA KEV listing has not been assigned. The vendor declined to engage during responsible disclosure efforts. Active community attention combined with public exploit availability suggests this vulnerability warrants prompt patching in any TinyFileManager deployments that cannot be immediately decommissioned or segmented from production environments.