CVE-2020-12103

Severity: high (CVSS 7.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-04-28 · updated 2026-06-17
Weakness: CWE-22

Description

In Tiny File Manager 2.4.1 there is a vulnerability in the ajax file backup copy functionality which allows authenticated users to create backup copies of files (with .bak extension) outside the scope in the same directory in which they are stored.

Affected products

prasathmani TinyFileManager: 2.4.1

References

https://cyberaz0r.info/2020/04/tiny-file-manager-multiple-vulnerabilities/
https://github.com/prasathmani/tinyfilemanager/commit/a0c595a8e11e55a43eeaa68e1a3ce76365f29d06
https://github.com/prasathmani/tinyfilemanager/issues/357
https://cyberaz0r.info/2020/04/tiny-file-manager-multiple-vulnerabilities/
https://github.com/prasathmani/tinyfilemanager/commit/a0c595a8e11e55a43eeaa68e1a3ce76365f29d06
https://github.com/prasathmani/tinyfilemanager/issues/357

Get alerted when CVE-2020-12103 or the next vulnerability affects your stack