alexusmai laravel-file-manager is vulnerable to Directory Traversal
Date: 2025-12
Affected: composer/alexusmai/laravel-file-manager
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: Low
CVE: CVE-2025-65345
CWE: CWE-22

alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The zip/archiving functionality allows an attacker to create archives containing files and directories outside the intended scope due to improper path validation.


Mitigations:

Architectural layers (MAESTRO):