CVE-2025-56399

CVE-2025-56399 대량 익스플로잇 CVE-2025-56399 – laravel-file-manager v3.3.1의 원격 코드 실행 취약점. Laravel File Manager의 잘못 구성된 설정을 악용하여 인증 없이 파일 업로드로 PHP 셸을 업로드하고 검증합니다. 설치 저장소 다운로드 git clone https://github.com/im-hanzou/CVE-2025-56399 저장소 폴더로 이동 cd CVE-2025-56399 필요 패키지 설치 pip install -r requirements.txt 사용법...

CVE-2025-65345

CVE-2025-65345 – laravel-file-manager v3.3.1 における ZIP 機能を介した認証済みパストラバーサルによるファイルシステム情報漏えい 🧭 概要 laravel-file-manager v3.3.1 以下には、認証済みディレクトリトラバーサル Directory Traversal の脆弱性が存在します。ファイルマネージャーインターフェースにアクセスできる攻撃者が、不適切なパス検証により、zip/アーカイブ機能を使用して、意図された範囲外のファイルやディレクトリを含むアーカイブを作成できる可能性があります。 🧱 影響を受けるコンポーネント...

CVE-2025-63307

CVE-2025-63307 – laravel-file-manager v3.3.1의 인증된 저장형 크로스 사이트 스크립팅 XSS 취약점 🧭 개요 laravel-file-manager v3.3.1 및 이하 버전에서 발견된 인증된 저장형 크로스 사이트 스크립팅 XSS 취약점으로, 파일 관리자 인터페이스에 접근 가능한 공격자가 업로드 또는 생성된 파일에 임의의 JavaScript 코드를 주입하고 유지할 수 있습니다. 악성 JavaScript가 포함된 특수하게 조작된 .html 또는 .svg 파일을 업로드하거나, 파일 관리자 내에서 직...

CVE-2025-65346

CVE-2025-65346 – laravel-file-manager v3.3.1의 UnZip 함수에서 발생하는 인증된 경로 탐색으로 인한 임의 파일 쓰기 🧭 개요 영향을 받는 애플리케이션의 unzip/extract 기능에서 발생하는 경로 탐색 취약점으로 인해 공격자는 압축 해제 중 임의의 파일 시스템 위치에 파일을 쓸 수 있습니다. 추출 루틴이 ZIP 항목 내부의 대상 경로를 검증하지 않기 때문에, 공격자는 경로 탐색 시퀀스예: ../../routes 또는 절대 경로가 포함된 ZIP 아카이브를 조작할 수 있습니다. 애플리케이션...

laravel-filemanager-unrestricted-upload

Laravel FileManager 无限制文件上传 CVE-2025-56399 CWE-434：危险类型文件无限制上传 CVSS 评分：8.5（高危） 📋 描述 本工具提供了 CVE-2025-56399 的概念验证（PoC），这是一个存在于 alexusmai/laravel-file-manager（版本 ≤ 3.3.1）中的严重漏洞。 该漏洞允许 经过身份验证的攻击者 通过上传精心构造的文件、绕过客户端验证并将其重命名为 PHP 扩展名，从而实现 远程代码执行（RCE） 。 此脚本自动化了整个流程： 检测 FileManager 端点（支持多种 Laravel...

CVE-2025-56399

CVE-2025-56399 – laravel-file-manager v3.3.1의 인증된 원격 코드 실행 🧭 개요 laravel-file-manager v3.3.1 이하에서 발견된 인증된 원격 코드 실행RCE 취약점으로 인해 파일 관리자 인터페이스에 접근 권한이 있는 공격자가 서버에서 임의의 코드를 실행할 수 있습니다. 허용된 비-PHP 확장자예: .png, .pdf를 가진 파일에 악성 PHP 코드를 포함하여 업로드한 다음 .php 확장자로 이름을 변경하거나, .php 파일을 직접 생성 및 편집함으로써, 공격자는 해당 파일이 ...

Exploit for CVE-2025-56399

Laravel FileManager Unrestricted File Upload CVE-2025-56399...

EUVD-2019-20081

UniSharp Laravel File Manager v2.0.0-alpha7 and v2.0 contain an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by sending multipart form data to the upload endpoint. Attackers can upload PHP files with the type parameter set to Files and execute...

CVE-2019-25673

UniSharp Laravel File Manager v2.0.0-alpha7 and v2.0 contain an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by sending multipart form data to the upload endpoint. Attackers can upload PHP files with the type parameter set to Files and execute...

CVE-2019-25673 UniSharp Laravel File Manager v2.0.0-alpha7 Arbitrary File Upload

UniSharp Laravel File Manager v2.0.0-alpha7 and v2.0 contain an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by sending multipart form data to the upload endpoint. Attackers can upload PHP files with the type parameter set to Files and execute...

CVE-2019-25673 UniSharp Laravel File Manager v2.0.0-alpha7 Arbitrary File Upload

UniSharp Laravel File Manager v2.0.0-alpha7 and v2.0 contain an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by sending multipart form data to the upload endpoint. Attackers can upload PHP files with the type parameter set to Files and execute...

CVE-2019-25673

UniSharp Laravel File Manager v2.0.0-alpha7 and v2.0 contain an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by sending multipart form data to the upload endpoint. Attackers can upload PHP files with the type parameter set to Files and execute...

CVE-2019-25673

UniSharp Laravel File Manager v2.0.0-alpha7 and v2.0 expose an arbitrary file upload vulnerability at the upload endpoint. An authenticated attacker can submit multipart form data to upload PHP files via the type parameter set to Files, then access the uploaded file in the working directory path ...

CVE-2019-25673: Unrestricted Upload of File with Dangerous Type

UniSharp Laravel File Manager v2.0.0-alpha7 and v2.0 contain an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by sending multipart form data to the upload endpoint. Attackers can upload PHP files with the type parameter set to Files and execute...

Laravel File Manager 代码问题漏洞

Laravel File Manager is a file manager developed by Aleksandr Manekin. The Laravel File Manager v2.0.0-alpha7 and v2.0 versions have code vulnerabilities. These vulnerabilities stem from the possibility of arbitrary file uploads, which could allow authenticated attackers to upload malicious files...

PT-2026-30482

UniSharp Laravel File Manager v2.0.0-alpha7 and v2.0 contain an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by sending multipart form data to the upload endpoint. Attackers can upload PHP files with the type parameter set to Files and execute...

Directory Traversal

alexusmai laravel-file-manager is vulnerable to Directory Traversal. The vulnerability is due to improper path validation in the zip/archiving functionality, which allows an attacker to create crafted archives that include files and directories outside the intended scope...

Directory Traversal

alexusmai/laravel-file-manager is vulnerable to Directory Traversal. The vulnerability is due to insufficient validation of extraction paths during archive unzip functionality, which allows an attacker to write files to arbitrary locations on the filesystem...

CVE-2025-65346

alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The unzip/extraction functionality improperly allows archive contents to be written to arbitrary locations on the filesystem due to insufficient validation of extraction paths...

GHSA-Q5HG-WPPQ-R2CC alexusmai laravel-file-manager is vulnerable to Directory Traversal via the unzip/extraction functionality

alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The unzip/extraction functionality improperly allows archive contents to be written to arbitrary locations on the filesystem due to insufficient validation of extraction paths...