CVE-2025-65346
CriticalSummary
alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The unzip/extraction functionality improperly allows archive contents to be written to arbitrary locations on the filesystem due to insufficient validation of extraction paths.
Risk Assessment
An attacker can write files to arbitrary locations on the server, potentially leading to overwriting critical files or executing malicious code.
Recommendation
Update alexusmai laravel-file-manager to the latest version that includes a fix. Additionally, implement path validation during archive extraction.
Original NVD description (English source)
alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The unzip/extraction functionality improperly allows archive contents to be written to arbitrary locations on the filesystem due to insufficient validation of extraction paths.