CVE-2025-46651

Tiny File Manager through 2.6 contains a server-side request forgery (SSRF) vulnerability in the URL upload feature. Due to insufficient validation of user-supplied URLs, an attacker can send crafted requests to localhost by using http://www.127.0.0.1.example.com/ or a similarly constructed domain name. This may lead to unauthorized port scanning or access to internal-only services.

• CWE-918

• https://github.com/RobertoLuzanilla/tinyfilemanager-security-advisories/blob/main/CVE-2025-46651.mdMitigation, Third Party Advisory
• https://github.com/prasathmani/tinyfilemanager/blob/master/tinyfilemanager.php#L608Product

Published

Feb 3, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-46643Dell PowerProtect Data Domain with Data Domain Operating Sys…4.4
• CVE-2025-46644Dell PowerProtect Data Domain with Data Domain Operating Sys…6.7
• CVE-2025-46645Dell PowerProtect Data Domain with Data Domain Operating Sys…7.2
• CVE-2025-46646In Artifex Ghostscript before 10.05.0, decode_utf8 in base/g…4.5
• CVE-2025-46647A vulnerability of plugin openid-connect in Apache APISIX. …5.3
• CVE-2025-4665WordPress plugin Contact Form CFDB7 versions up to and inclu…9.6
• CVE-2025-46652In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vuln…6.1
• CVE-2025-46653Formidable (aka node-formidable) 2.1.0 through 3.x before 3.…3.1
• CVE-2025-46654CodiMD through 2.2.0 has a CSP-based protection mechanism ag…4.9
• CVE-2025-46655CodiMD through 2.5.4 has a CSP-based protection mechanism ag…4.9
• CVE-2025-46656python-markdownify (aka markdownify) before 0.14.1 allows la…3.3
• CVE-2025-46657Karaz Karazal through 2025-04-14 allows reflected XSS via th…6.1