# CVE-2019-25673: UniSharp Laravel File Manager arbitrary file upload in upload endpoint

Source: https://junglewise.ai/threats/cve-2019-25673-unisharp-laravel-file-manager-arbitrary-file-upload-in-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-05. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2019-25673 · Severity: high · CVSS 8.8 · Published 2026-04-05

UniSharp Laravel File Manager is a media management tool used in web applications to handle file uploads and galleries. A security flaw allows logged-in users to upload restricted file types, such as PHP scripts, to the server. An attacker could use this to take full control of the web server, potentially leading to data theft or complete service disruption.

## Quick answers

**Is CVE-2019-25673 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-25673 being exploited in the wild.

**How severe is CVE-2019-25673?** High severity, with a CVSS score of 8.8, published 5 April 2026.

**Which products and versions are affected?** UniSharp Laravel File Manager 2.0.0-alpha7, 2.0.0.

**Is there a fix for CVE-2019-25673?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2019-25673 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2019-25673?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An arbitrary file upload vulnerability exists in UniSharp Laravel File Manager v2.0.0-alpha7 and v2.0. The flaw is located in the upload endpoint, where the application fails to properly validate file extensions when the 'type' parameter is set to 'Files'. An authenticated attacker can send a multipart/form-data POST request containing a PHP shell. By specifying a 'working_dir' and accessing the uploaded file via its web-reachable path, the attacker can achieve remote code execution (RCE) with the privileges of the web server user. Public exploits are available for this vulnerability.

## Affected products

- UniSharp Laravel File Manager 2.0.0-alpha7, 2.0.0

## Timeline

- 2017-06-25: disclosed: Initial issue reported on GitHub repository
- 2019-02-15: other: Exploit code published on Exploit-DB
- 2026-04-05: advisory: CVE published/updated in NVD

## References

- [https://github.com/UniSharp/laravel-filemanager](https://github.com/UniSharp/laravel-filemanager)
- [https://github.com/UniSharp/laravel-filemanager/issues/356](https://github.com/UniSharp/laravel-filemanager/issues/356)
- [https://www.exploit-db.com/exploits/46389](https://www.exploit-db.com/exploits/46389)
- [https://www.vulncheck.com/advisories/unisharp-laravel-file-manager-alpha7-arbitrary-file-upload](https://www.vulncheck.com/advisories/unisharp-laravel-file-manager-alpha7-arbitrary-file-upload)