CVE-2025-46001

The simogeo/filemanager (specifically version v2.3.0 ) is vulnerable to an arbitrary file upload vulnerability within the is_allowed_file_type() function. Due to insufficient checks and improper file type validation, an attacker can upload a specially crafted PHP file to achieve remote code execu...

CVE-2025-46002

The simogeo/filemanager open-source file manager (v2.5.0 and below) is vulnerable to a Relative Path Traversal vulnerability. This issue stems from improper input validation, where the filemanager.php endpoint fails to sanitize user input in crafted HTTP requests, allowing an attacker to access f...

CVE-2025-46000

The simogeo/filemanager open-source package (specifically commit c75b914 v.2.5.0 ) contains an arbitrary file upload vulnerability in the /rsc/filemanager.rsc.class.php component. Attackers can bypass restrictions defined in filemanager.config.json by uploading a crafted SVG file , leading to arb...