CVE-2025-65346 | THREATINT

Description

alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The unzip/extraction functionality improperly allows archive contents to be written to arbitrary locations on the filesystem due to insufficient validation of extraction paths.

PUBLISHED Reserved 2025-11-18 | Published 2025-12-04 | Updated 2025-12-05 | Assigner mitre

References

github.com/...asin/CVE-2025-65346/blob/main/POC-CVE-65346.md exploit

github.com/alexusmai/laravel-file-manager

github.com/Theethat-Thamwasin/CVE-2025-65346

cve.org (CVE-2025-65346)

nvd.nist.gov (CVE-2025-65346)