Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimetype and inserting the . character after the php file extension. This allows the attacker to execute malicious code.
Recommended action: Upgrade to 2.9.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
UniSharp laravel-filemanager (aka Laravel Filemanager) with league/flysystem version < 2.0.0 allows download?workingdir=%2F.. directory traversal to read arbitrary files, as exploited in the wild in June 2022. Since v2.6.4, UniSharp laravel-filemanager (aka Laravel Filemanager) requires users to install league/flysystem version = 2.0.0.
Recommended action: Upgrade to 2.6.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This affects the package unisharp/laravel-filemanager prior to version 2.6.2. The upload() function does not sufficiently validate the file type when uploading. An attacker may be able to reproduce the following steps: - Install a package with a web Laravel application. - Navigate to the Upload window - Upload an image file, then capture the request - Edit the request contents with a malicious file (webshell) - Enter the path of file uploaded on URL - Remote Code Execution Note: Prevention for bad extensions can be done by using a whitelist in the config file(lfm.php). Corresponding document can be found in the here.
Recommended action: Upgrade to 2.6.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.