# CVE-2025-56399: alexusmai laravel-file-manager RCE via file upload and rename

Source: https://junglewise.ai/threats/cve-2025-56399-alexusmai-laravel-file-manager-rce-via-file-upload-and-rename  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-28. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-56399 · Severity: high · CVSS 8.8 · Published 2025-10-28

A vulnerability in the alexusmai laravel-file-manager library, which provides file management capabilities for Laravel applications, allows logged-in users to run unauthorized commands on the server. By bypassing file upload restrictions and renaming files to executable formats, an attacker can take full control of the web server, access sensitive customer data, or disrupt business operations. This issue affects any application using version 3.3.1 or earlier of this component.

Technologies: [Alexusmai Laravel File Manager](https://junglewise.ai/threats/technologies/laravel-file-manager). Vendors: [Alexusmai](https://junglewise.ai/threats/vendors/alexusmai).

## Quick answers

**Is CVE-2025-56399 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-56399 being exploited in the wild.

**How severe is CVE-2025-56399?** High severity, with a CVSS score of 8.8, published 28 October 2025.

**Which products and versions are affected?** Alexusmai Laravel File Manager <= 3.3.1.

**Is there a fix for CVE-2025-56399?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-56399 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-56399?** Check whether you run Alexusmai Laravel File Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authenticated Remote Code Execution (RCE) vulnerability exists in alexusmai laravel-file-manager through version 3.3.1 due to improper validation in the file upload and rename APIs. The application performs client-side validation that can be bypassed to upload files containing PHP code with non-executable extensions (e.g., .png). Once uploaded, an attacker can use the rename API to change the extension to .php. Because the upload directory allows script execution, accessing the renamed file via a public URL triggers the execution of the embedded PHP payload. Alternatively, the 'Create File' and 'Edit' functions can be used to directly place PHP code on the server. Remediation includes implementing server-side MIME-type validation and disabling script execution in the storage directories.

## Affected products

- alexusmai laravel-file-manager <= 3.3.1

## Timeline

- 2025-10-28: disclosed
- 2025-10-28: advisory

## References

- [https://github.com/Theethat-Thamwasin/CVE-2025-56399](https://github.com/Theethat-Thamwasin/CVE-2025-56399)

## Related threats

- [alexusmai laravel-file-manager is vulnerable to Directory Traversal via the unzip/extraction functionality](https://junglewise.ai/threats/cve-2025-65346-alexusmai-laravel-file-manager-is-vulnerable-to-directory)
- [alexusmai laravel-file-manager is vulnerable to Directory Traversal](https://junglewise.ai/threats/cve-2025-65345-alexusmai-laravel-file-manager-is-vulnerable-to-directory)
- [alexusmai laravel-file-manager 3.3.1 is vulnerable to Cross Site Scripting (XSS). The application permits…](https://junglewise.ai/threats/cve-2025-63307-alexusmai-laravel-file-manager-3-3-1-is-vulnerable-to-cross-site)