LOW

GHSA-rr44-8j7r-jg2q

alexusmai laravel-file-manager is vulnerable to Directory Traversal

Details

alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The zip/archiving functionality allows an attacker to create archives containing files and directories outside the intended scope due to improper path validation.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/alexusmai/laravel-file-manager

Introduced in: 0

No fixed version published yet for alexusmai/laravel-file-manager (composer). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-65345[ADVISORY]
https://github.com/alexusmai/laravel-file-manager[PACKAGE]
https://github.com/tlekrean/CVE-2025-65345[WEB]