CVE-2025-65346

Summary

alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The unzip/extraction functionality improperly allows archive contents to be written to arbitrary locations on the filesystem due to insufficient validation of extraction paths.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: yes
  • Technical Impact: total

Additional References

• https://github.com/Theethat-Thamwasin/CVE-2025-65346/blob/main/POC-CVE-65346.md

References

• https://github.com/alexusmai/laravel-file-manager
• https://github.com/Theethat-Thamwasin/CVE-2025-65346

• ←Previous
• Next→