{"id":"CVE-2022-45476","state":"PUBLISHED","title":"Tiny File Manager version 2.4.8 executes the code of files uploaded by users of the application, instead of just returning them for download. This is possible because the applicati","description":"Tiny File Manager version 2.4.8 executes the code of files uploaded by users of the application, instead of just returning them for download. This is possible because the application is vulnerable to insecure file upload.\n\n\n","publishedAt":"2022-11-25T00:00:00.000Z","updatedAt":"2025-04-29T14:05:00.400Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"Fluid Attacks","products":["n/a Tiny File Manager"],"affected":[{"vendor":"n/a","product":"Tiny File Manager","defaultStatus":"unaffected","versions":[{"version":"2.4.8","status":"affected"}]}],"references":["https://github.com/prasathmani/tinyfilemanager/","https://fluidattacks.com/advisories/mosey/"],"weaknesses":["CWE-434"],"ingestedAt":"2026-10-29T19:50:51.061Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/45xxx/CVE-2022-45476.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-45476","state":"PUBLISHED","datePublished":"2022-11-25T00:00:00.000Z","dateUpdated":"2025-04-29T14:05:00.400Z","assignerShortName":"Fluid Attacks","assignerOrgId":"84fe0718-d6bb-4716-a7e8-81a6d1daa869","dateReserved":"2022-11-18T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Tiny File Manager version 2.4.8 executes the code of files uploaded by users of the application, instead of just returning them for download. This is possible because the application is vulnerable to insecure file upload.\n\n\n"}],"affected":[{"vendor":"n/a","product":"Tiny File Manager","defaultStatus":"unaffected","versions":[{"version":"2.4.8","status":"affected"}]}],"references":[{"url":"https://github.com/prasathmani/tinyfilemanager/"},{"url":"https://fluidattacks.com/advisories/mosey/"}],"problemTypes":[{"descriptions":[{"description":"Remote command execution","lang":"en"}]}],"providerMetadata":{"shortName":"Fluid Attacks","orgId":"84fe0718-d6bb-4716-a7e8-81a6d1daa869","dateUpdated":"2022-12-05T12:08:51.944Z"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://github.com/prasathmani/tinyfilemanager/","tags":["x_transferred"]},{"url":"https://fluidattacks.com/advisories/mosey/","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T14:17:03.575Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-04-29T14:04:39.679839Z","id":"CVE-2022-45476","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-434","type":"CWE","lang":"en","description":"CWE-434 Unrestricted Upload of File with Dangerous Type"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-29T14:05:00.400Z"}}]}}}