CVE-2025-56399
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
In laravel-file-manager version 3.3.1 and earlier, an authenticated attacker can upload a .png file containing PHP code, which despite client-side validation failure is saved on the server. Using the rename API, the attacker changes the extension to .php, enabling remote code execution (RCE).
Risk Assessment
The organization risks complete server compromise, allowing the attacker to execute arbitrary commands, steal data, or install malware.
Recommendation
Immediately update laravel-file-manager to the latest version and implement server-side file validation to block uploads with dangerous extensions.
Other vulnerabilities in laravel-file-manager
See all- CVE-2025-65345Medium
alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The zip/archiving functionality allows an attacker to create archives containing files and directories outside the intended scope due to improper path validation.
- CVE-2025-63307High
alexusmai laravel-file-manager 3.3.1 is vulnerable to Cross Site Scripting (XSS). The application permits user-controlled upload, create, and rename of files to HTML and SVG types and serves those files inline without adequate content-type validation or output sanitization.
Original NVD description (English source)
alexusmai laravel-file-manager 3.3.1 and before allows an authenticated attacker to achieve Remote Code Execution (RCE) through a crafted file upload. A file with a '.png` extension containing PHP code can be uploaded via the file manager interface. Although the upload appears to fail client-side validation, the file is still saved on the server. The attacker can then use the rename API to change the file extension to `.php`, and upon accessing it via a public URL, the server executes the embedded code.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS