MEDIUM6.5
GHSA-5m2h-7rf2-rpx6
UniSharp Laravel Filemanager directory traversal vulnerability
Quick fix
GHSA-5m2h-7rf2-rpx6 — unisharp/laravel-filemanager: upgrade to the fixed version with the command below.
composer require unisharp/laravel-filemanager:^2.6.4Details
UniSharp laravel-filemanager (aka Laravel Filemanager) with `league/flysystem` version `< 2.0.0` allows download?working_dir=%2F.. directory traversal to read arbitrary files, as exploited in the wild in June 2022.
Since `v2.6.4`, UniSharp laravel-filemanager (aka Laravel Filemanager) requires users to install `league/flysystem` version `>= 2.0.0`.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/unisharp/laravel-filemanager
Introduced in:
0Fixed in: 2.6.4Fix
composer require unisharp/laravel-filemanager:^2.6.4References
- https://nvd.nist.gov/vuln/detail/CVE-2022-40734[ADVISORY]
- https://github.com/UniSharp/laravel-filemanager/issues/1150[WEB]
- https://github.com/UniSharp/laravel-filemanager/issues/1150#issuecomment-1320186966[WEB]
- https://github.com/UniSharp/laravel-filemanager/issues/1150#issuecomment-1825310417[WEB]
- https://github.com/UniSharp/laravel-filemanager/commit/8a357d02e8f54ddf130961c64ff2cfc1882bbfcf[WEB]
- https://github.com/UniSharp/laravel-filemanager[PACKAGE]