CVE-2025-63307

Summary

alexusmai laravel-file-manager 3.3.1 is vulnerable to Cross Site Scripting (XSS). The application permits user-controlled upload, create, and rename of files to HTML and SVG types and serves those files inline without adequate content-type validation or output sanitization.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: total

Additional References

• https://github.com/Theethat-Thamwasin/CVE-2025-63307/blob/main/POC-CVE-63307.md

References

• https://github.com/alexusmai/laravel-file-manager
• https://github.com/Theethat-Thamwasin/CVE-2025-63307

• ←Previous
• Next→