CRITICAL Published December 4, 2025

CVE-2025-65346

alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The unzip/extraction functionality improperly allows archive contents to be written to arbitrary locations on the filesystem due to insufficient validation of extraction paths.

CVSS base score

9.1 (v3.1)

Severity

CRITICAL

Attack vector

Network

Weakness

CWE-22

Last modified

November 4, 2026

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

alexusmai laravel file manager

References

github.com Third Party Advisory
github.com Product
github.com Exploit, Third Party Advisory

View full NVD advisory →

More alexusmai vulnerabilities

Published the same day

← Back to CVE watch

CVE-2025-65346

Affected products

References

More alexusmai vulnerabilities

Published the same day

Related reading