EIP-2026-112706

PRE-CVE

TinyCMS 1.3 - '/admin/admin.php?do' Traversal Local File Inclusion

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-112706. PoCs published by KedAns-Dz.

AI-analyzed exploit summary The provided code is a writeup describing local file inclusion (LFI) and arbitrary file upload vulnerabilities in TinyCMS 1.3. It includes a basic HTML form demonstrating the LFI exploit via path traversal.

Description

TinyCMS 1.3 - '/admin/admin.php?do' Traversal Local File Inclusion

Exploits (1)

exploitdb WRITEUP VERIFIED

by KedAns-Dz · textwebappsphp

https://www.exploit-db.com/exploits/37342

View Code ZIP pw:eip

The provided code is a writeup describing local file inclusion (LFI) and arbitrary file upload vulnerabilities in TinyCMS 1.3. It includes a basic HTML form demonstrating the LFI exploit via path traversal.

Classification

Writeup 90%

Attack Type

Info Leak

Complexity

Trivial

Reliability

Theoretical

Target: TinyCMS 1.3

No auth needed

Prerequisites: Access to the vulnerable TinyCMS admin interface

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1006 - Direct Volume Access

devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026