CVE-2025-65346

alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The unzip/extraction functionality improperly allows archive contents to be written to arbitrary locations on the filesystem due to insufficient validation of extraction paths.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
mitreCNA
---
---
CISA-ADPADP
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 48%
VendorProductVersion
alexusmailaravel_file_manager
𝑥
≤ 3.3.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/Theethat-Thamwasin/CVE-2025-65346
https://github.com/alexusmai/laravel-file-manager
https://github.com/Theethat-Thamwasin/CVE-2025-65346/blob/main/POC-CVE-65346.md