alexusmai laravel-file-manager is vulnerable to Directory Traversal via the unzip/extraction functionality
Date: 2025-12
Affected: composer/alexusmai/laravel-file-manager
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2025-65346
CWE: CWE-22
CVSS: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The unzip/extraction functionality improperly allows archive contents to be written to arbitrary locations on the filesystem due to insufficient validation of extraction paths.


Mitigations:

Architectural layers (MAESTRO):