CVE-2025-65345
📋 TL;DR
CVE-2025-65345 is a directory traversal vulnerability in alexusmai/laravel-file-manager versions 3.3.1 and below. It allows attackers to create archives containing files and directories outside the intended scope via improper path validation in the zip/archiving functionality. This affects any Laravel application using this vulnerable file manager package.
💻 Affected Systems
- alexusmai/laravel-file-manager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker could exfiltrate sensitive files (configuration files, environment variables, database credentials, source code) from the server, potentially leading to complete system compromise.
Likely Case
Unauthorized access to sensitive files stored on the server, potentially exposing application secrets, user data, or internal documents.
If Mitigated
Limited impact if proper file permissions restrict access to sensitive directories and files are stored outside web-accessible paths.
🎯 Exploit Status
Exploitation requires access to the file manager interface, but the vulnerability is straightforward to exploit once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.3.2 or later
Vendor Advisory: https://github.com/alexusmai/laravel-file-manager
Restart Required: No
Instructions:
1. Update composer.json to require 'alexusmai/laravel-file-manager' version '^3.3.2'. 2. Run 'composer update alexusmai/laravel-file-manager'. 3. Clear Laravel cache with 'php artisan cache:clear'.
🔧 Temporary Workarounds
Disable zip functionality
allTemporarily disable the zip/archive functionality in the file manager configuration.
Edit config/file-manager.php and set 'allow_zip' => false
Restrict file manager access
allImplement strict authentication and authorization controls to limit access to the file manager interface.
🧯 If You Can't Patch
- Implement strict file system permissions to limit what directories the web server user can access.
- Deploy a web application firewall (WAF) with rules to detect and block directory traversal attempts.
🔍 How to Verify
Check if Vulnerable:
Check composer.lock or run 'composer show alexusmai/laravel-file-manager' to see installed version. If version is 3.3.1 or below, you are vulnerable.Check Version:
composer show alexusmai/laravel-file-manager | grep versionsVerify Fix Applied:
After updating, verify version is 3.3.2 or higher with 'composer show alexusmai/laravel-file-manager'.📡 Detection & Monitoring
Log Indicators:
- Unusual archive creation requests with '../' sequences in file paths
- Multiple failed archive creation attempts with path traversal patterns
Network Indicators:
- HTTP requests to file manager endpoints containing '../' patterns in POST data
SIEM Query:
source="web_server_logs" AND (url_path="*file-manager*" AND (request_body="*../*" OR request_body="*..\\*"))