CVE-2021-40964

MEDIUM

TinyFileManager <=2.4.6 - Path Traversal

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2021-40964. PoCs published by Z3R0space, Z3R0-0x30.

AI-analyzed exploit summary This repository contains a functional Bash script that exploits CVE-2021-40964, an authenticated RCE vulnerability in Tiny File Manager <= 2.4.6. The exploit leverages weak upload validation and webroot disclosure to upload a malicious PHP shell, enabling remote command execution.

Description

A Path Traversal vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload a file (with Admin credentials or with the CSRF vulnerability) with the "fullpath" parameter containing path traversal strings (../ and ..\) in order to escape the server's intended working directory and write malicious files onto any directory on the computer.

Exploits (3)

nomisec WORKING POC
by Z3R0space · poc
https://github.com/Z3R0space/CVE-2021-40964

This repository contains a functional Bash script that exploits CVE-2021-40964, an authenticated RCE vulnerability in Tiny File Manager <= 2.4.6. The exploit leverages weak upload validation and webroot disclosure to upload a malicious PHP shell, enabling remote command execution.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Tiny File Manager <= 2.4.6
Auth required
Prerequisites: curl · jq · admin credentials
devstral-2 · analyzed Feb 25, 2026 Full analysis →
nomisec WORKING POC
by Z3R0-0x30 · poc
https://github.com/Z3R0-0x30/CVE-2021-40964

This is a functional Bash script that exploits CVE-2021-40964 in Tiny File Manager <= 2.4.6, leveraging authenticated arbitrary file upload and path disclosure to achieve remote code execution via a PHP web shell.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Tiny File Manager <= 2.4.6
Auth required
Prerequisites: curl · jq · valid admin credentials
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC
shellwebappsphp
https://www.exploit-db.com/exploits/50828

This script exploits an authenticated RCE vulnerability in Tiny File Manager <= 2.4.6 by leveraging a path traversal flaw to upload a malicious PHP shell. It first authenticates, leaks the webroot path via a full path disclosure bug, and then uploads a shell to achieve remote command execution.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Tiny File Manager <= 2.4.6
Auth required
Prerequisites: valid admin credentials · curl and jq installed on attacker machine
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/166330/Tiny-File-Manager-2.4.6-Shell-Upload.html

Scores

CVSS v3 6.5
EPSS 0.0844
EPSS Percentile 92.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Details

CWE
CWE-22
Status published
Products (1)
prasathmani/tiny_file_manager < 2.4.6
Published Sep 15, 2021
Tracked Since Feb 18, 2026