alexusmai laravel-file-manager is vulnerable to Directory Traversal via the unzip/extraction functionality

CRITICAL 9.1CVE-2025-65346 · GHSA-q5hg-wppq-r2cc · Published 04/12/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
alexusmai/laravel-file-manager Packagist	`≤ 3.3.1`	No fix yet
laravel file manager alexusmai	`≤ 3.3.1`	No fix yet

Description

alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The unzip/extraction functionality improperly allows archive contents to be written to arbitrary locations on the filesystem due to insufficient validation of extraction paths.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2025-65346 · ADVISORY
Theethat-Thamwasin/CVE-2025-65346 · WEB
Theethat-Thamwasin/CVE-2025-65346 · WEB
alexusmai/laravel-file-manager · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free