Vulnerability record · CVE-2021-45010 · published 15 March 2022
CVE-2021-45010: Tiny File Manager path traversal in upload leads to RCE
PPrasathmani · Tiny File Manager
Tiny File Manager before 2.4.7 contains a path traversal flaw in the file upload functionality in tinyfilemanager.php. An authenticated user can traverse out of the intended upload directory and write a malicious PHP file into the webroot, which then executes as server-side code.
Description
A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with valid user accounts) to upload malicious PHP files to the webroot, leading to code execution.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityAuthenticated remote code execution with public exploit code and very high EPSS, though it requires a valid account and is not in KEV.
What it is
Tiny File Manager before 2.4.7 contains a path traversal flaw in the file upload functionality in tinyfilemanager.php. An authenticated user can traverse out of the intended upload directory and write a malicious PHP file into the webroot, which then executes as server-side code.
Impact
An attacker with a valid low-privileged account gains remote code execution on the web server, compromising confidentiality, integrity and availability of the host and any data it can reach.
Attack surface
Reachable over the network through the file upload endpoint of tinyfilemanager.php; the CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates a valid user account is required but no user interaction.
Exploitation
Not listed in CISA KEV, but public exploit code is referenced (Packet Storm shell upload, GitHub exploit scripts) and EPSS is 0.7008 (99.3rd percentile), indicating high likelihood of exploitation activity.
What to do
- Upgrade Tiny File Manager to 2.4.7 or later, applying the upstream commit/pull request fixes.
- If upgrade is not immediately possible, restrict or disable the upload feature and remove write access to the webroot for the web server user.
- Enforce server-side validation of upload paths and filenames, rejecting traversal sequences and disallowing executable extensions.
- Store uploaded files outside the webroot and serve them through a handler that never executes them.
- Audit and rotate credentials for all Tiny File Manager accounts, and remove unused accounts.
Detection
- Monitor web server logs for upload requests to tinyfilemanager.php containing traversal sequences such as ../ or encoded variants.
- Alert on newly created .php files in web-accessible directories, especially those written by the web server user.
- Hunt for outbound connections or child processes spawned by the web server user that indicate uploaded shell execution.
- Review file integrity monitoring for unexpected changes in the webroot.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2021-45010 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-45010), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
