CVE-2025-46651

Tiny File Manager through 2.6 contains a server-side request forgery (SSRF) vulnerability in the URL upload feature. Due to insufficient validation of...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Tiny File Manager through 2.6 contains a server-side request forgery (SSRF) vulnerability in the URL upload feature. Due to insufficient validation of user-supplied URLs, an attacker can send crafted requests to localhost by using http://www.127.0.0.1.example.com/ or a similarly constructed domain name. This may lead to unauthorized port scanning or access to internal-only services.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Références

advisory github.com
advisory github.com
advisory nvd.nist.gov
web github.com