CVE-2025-63307 | THREATINT

Description

alexusmai laravel-file-manager 3.3.1 is vulnerable to Cross Site Scripting (XSS). The application permits user-controlled upload, create, and rename of files to HTML and SVG types and serves those files inline without adequate content-type validation or output sanitization.

PUBLISHED Reserved 2025-10-27 | Published 2025-11-06 | Updated 2025-11-06 | Assigner mitre

References

github.com/...asin/CVE-2025-63307/blob/main/POC-CVE-63307.md exploit

github.com/alexusmai/laravel-file-manager

github.com/Theethat-Thamwasin/CVE-2025-63307

cve.org (CVE-2025-63307)

nvd.nist.gov (CVE-2025-63307)

Download JSON