alexusmai/laravel-file-manager · Security
alexusmai laravel-file-manager is vulnerable to Directory Traversal
- GHSA ID
- GHSA-rr44-8j7r-jg2q
- CVE ID
- CVE-2025-65345
- Severity
- low
- Published
- Updated
- CVSS v4
- 2.9 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Description
alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The zip/archiving functionality allows an attacker to create archives containing files and directories outside the intended scope due to improper path validation.
CWEs
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')