Executive brief
UniSharp Laravel File Manager is a media management tool used in web applications to handle file uploads and galleries. A security flaw allows logged-in users to upload restricted file types, such as PHP scripts, to the server. An attacker could use this to take full control of the web server, potentially leading to data theft or complete service disruption.
Technical details
An arbitrary file upload vulnerability exists in UniSharp Laravel File Manager v2.0.0-alpha7 and v2.0. The flaw is located in the upload endpoint, where the application fails to properly validate file extensions when the 'type' parameter is set to 'Files'. An authenticated attacker can send a multipart/form-data POST request containing a PHP shell. By specifying a 'working_dir' and accessing the uploaded file via its web-reachable path, the attacker can achieve remote code execution (RCE) with the privileges of the web server user. Public exploits are available for this vulnerability.
Affected products
- UniSharp Laravel File Manager 2.0.0-alpha7, 2.0.0
Timeline
- 2017-06-25: disclosed: Initial issue reported on GitHub repository
- 2019-02-15: other: Exploit code published on Exploit-DB
- 2026-04-05: advisory: CVE published/updated in NVD