| Package | Affected versions | Patched versions |
|---|---|---|
| unisharp/laravel-filemanager | < 2.6.4 | 2.6.4 |
| laravel filemanager | ≤ 2.5.1 |
UniSharp laravel-filemanager (aka Laravel Filemanager) with league/flysystem version < 2.0.0 allows download?working_dir=%2F.. directory traversal to read arbitrary files, as exploited in the wild in June 2022.
Since v2.6.4, UniSharp laravel-filemanager (aka Laravel Filemanager) requires users to install league/flysystem version >= 2.0.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free