CVE-2025-65346
📋 TL;DR
CVE-2025-65346 is a directory traversal vulnerability in alexusmai/laravel-file-manager that allows attackers to write arbitrary files to any location on the server filesystem. This occurs due to insufficient validation of extraction paths in the unzip functionality. Any Laravel application using vulnerable versions of this file manager package is affected.
💻 Affected Systems
- alexusmai/laravel-file-manager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise via arbitrary file write leading to remote code execution, data exfiltration, or system takeover.
Likely Case
Unauthorized file writes to sensitive directories, potentially leading to web shell deployment, data manipulation, or privilege escalation.
If Mitigated
Limited impact if file permissions restrict write access to critical system directories and proper input validation is implemented.
🎯 Exploit Status
Exploitation requires access to the file manager interface. Public proof-of-concept demonstrates the directory traversal technique.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.3.2 or later
Vendor Advisory: https://github.com/alexusmai/laravel-file-manager
Restart Required: No
Instructions:
1. Update composer.json to require 'alexusmai/laravel-file-manager:^3.3.2'. 2. Run 'composer update alexusmai/laravel-file-manager'. 3. Clear Laravel cache with 'php artisan cache:clear'.
🔧 Temporary Workarounds
Disable Archive Extraction
allTemporarily disable the unzip/extract functionality in the file manager configuration.
Edit config/file-manager.php and set 'allow_upload' => false for zip files or disable extraction features
Input Validation Middleware
allImplement custom middleware to validate extraction paths before processing.
Create middleware to sanitize and validate file extraction paths using realpath() and directory whitelisting
🧯 If You Can't Patch
- Implement strict file permission controls to restrict write access to web directories only
- Deploy web application firewall (WAF) rules to detect and block directory traversal patterns in file operations
🔍 How to Verify
Check if Vulnerable:
Check composer.lock or vendor/alexusmai/laravel-file-manager/composer.json for version <=3.3.1Check Version:
composer show alexusmai/laravel-file-manager | grep versionsVerify Fix Applied:
Confirm version is 3.3.2 or higher in composer.lock and test archive extraction with malicious path payloads📡 Detection & Monitoring
Log Indicators:
- Unusual file write operations outside expected directories
- Archive extraction attempts with '../' patterns in paths
- Failed permission errors for system directory writes
Network Indicators:
- POST requests to file manager endpoints with archive files containing traversal paths
SIEM Query:
source='web_logs' AND (uri_path LIKE '%/laravel-file-manager%' AND (request_body LIKE '%..%' OR request_body LIKE '%zip%' OR request_body LIKE '%extract%'))