High severity · published Dec 28, 2025
CVE-2025-15138
prasathmani TinyFileManager tinyfilemanager.php path traversal
7.2
CVSS
0.7%
EPSS
No
On KEV
Description
A flaw has been found in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of the file tinyfilemanager.php. This manipulation of the argument fullpath causes path traversal. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TI
TinyFileManager · prasathmani
2.0; 2.1; 2.2; 2.3; 2.4; 2.5; +1 more · source: vendor
TF
Tiny File Manager · Prasathmani
through 2.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-15138
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-15138
Exploit
https://mesquite-dream-86b.notion.site/tinyfilemanager-File-Upload-RCE-Report-2c7512562197800d86b3e68534a56a91
Permissions Required
https://vuldb.com/?ctiid.338516
Third Party Advisory
https://vuldb.com/?id.338516
Third Party Advisory
https://vuldb.com/?submit.714177
More from TinyFileManager
6.3
CVE-2026-116044
prasathmani TinyFileManager Remote URL File Upload tinyfilemanager.php unrestricted upload
6.3
CVE-2026-108801
prasathmani TinyFileManager tinyfilemanager.php move_uploaded_file unrestricted upload
6.3
CVE-2026-6497
prasathmani TinyFileManager File Upload filemanager.php server-side request forgery
5.4
CVE-2026-6496
prasathmani TinyFileManager POST Parameter filemanager.php path traversal