Executive brief
A vulnerability in the alexusmai laravel-file-manager library, which provides file management capabilities for Laravel applications, allows logged-in users to run unauthorized commands on the server. By bypassing file upload restrictions and renaming files to executable formats, an attacker can take full control of the web server, access sensitive customer data, or disrupt business operations. This issue affects any application using version 3.3.1 or earlier of this component.
Technical details
An authenticated Remote Code Execution (RCE) vulnerability exists in alexusmai laravel-file-manager through version 3.3.1 due to improper validation in the file upload and rename APIs. The application performs client-side validation that can be bypassed to upload files containing PHP code with non-executable extensions (e.g., .png). Once uploaded, an attacker can use the rename API to change the extension to .php. Because the upload directory allows script execution, accessing the renamed file via a public URL triggers the execution of the embedded PHP payload. Alternatively, the 'Create File' and 'Edit' functions can be used to directly place PHP code on the server. Remediation includes implementing server-side MIME-type validation and disabling script execution in the storage directories.
Affected products
- alexusmai laravel-file-manager <= 3.3.1
Timeline
- 2025-10-28: disclosed
- 2025-10-28: advisory