Medium 4.3Published Feb 2, 2026

CVE-2025-46651Tiny File Manager through 2.6 contains a server-side request forgery (SSRF) vulnerability in the URL upload feature.

Updated under an hour ago (Oct 28, 2026, 6:00 AM ET)

Does this affect you?

It affects prasathmani tiny_file_manager. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for prasathmani tiny_file_manager

Exploited in the last 30 days

Tiny File Manager through 2.6 contains a server-side request forgery (SSRF) vulnerability in the URL upload feature. Due to insufficient validation of user-supplied URLs, an attacker can send crafted requests to localhost by using http://www.127.0.0.1.example.com/ or a similarly constructed domain name. This may lead to unauthorized port scanning or access to internal-only services.

CVSS: 4.3 MEDIUM (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness (CWE): CWE-918
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: mitre
NVD analysis: Analyzed
Record last updated: Feb 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

prasathmani tiny_file_manager prasathmani:tiny_file_manager	through 2.6	NVD

References

References

https://github.com/prasathmani/tinyfilemanager/blob/master/tinyfilemanager.php#L608	product
https://github.com/RobertoLuzanilla/tinyfilemanager-security-advisories/blob/main/CVE-2025-46651.md	mitigation, third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.