CVE-2026-6497

OVERVIEW: CVE-2026-6497 is a server-side request forgery (SSRF) vulnerability affecting TinyFileManager versions up to 2.6. The flaw exists in the file upload handler component (/filemanager.php) where manipulation of the uploadurl parameter allows attackers to initiate unauthorized server-side requests. This widely-deployed file management application is exposed to remote exploitation without requiring administrative privileges. SEVERITY: The vulnerability carries a CVSS v3.1 score of 6.3 (Medium) with a network-based attack vector requiring low complexity and low privileges. The impact is moderate, affecting confidentiality, integrity, and availability equally. While not rated as critical, the SSRF nature of this flaw could enable attackers to access internal systems, exfiltrate data, or pivot to other network resources depending on server configuration and network segmentation. EXPLOITATION STATUS: The vulnerability has been publicly disclosed with exploit code available in the wild. The vulnerability is currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as actively exploited in the wild, though EPSS scoring suggests relatively low predictive exploitation likelihood. The vendor has not responded to coordinated disclosure efforts, indicating no patch is forthcoming, leaving affected organizations dependent on compensating controls or alternative solutions.