CRITICAL9.1

GHSA-q5hg-wppq-r2cc

alexusmai laravel-file-manager is vulnerable to Directory Traversal via the unzip/extraction functionality

Details

alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The unzip/extraction functionality improperly allows archive contents to be written to arbitrary locations on the filesystem due to insufficient validation of extraction paths.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/alexusmai/laravel-file-manager

Introduced in: 0

No fixed version published yet for alexusmai/laravel-file-manager (composer). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-65346[ADVISORY]
https://github.com/Theethat-Thamwasin/CVE-2025-65346[WEB]
https://github.com/Theethat-Thamwasin/CVE-2025-65346/blob/main/POC-CVE-65346.md[WEB]
https://github.com/alexusmai/laravel-file-manager[PACKAGE]