Listen to this Post
The vulnerability exists within the file archive extraction function of the Laravel File Manager package. The endpoint responsible for unzipping uploaded archives does not properly validate or sanitize the file paths contained within a ZIP archive. When processing an archive, the package uses the archive’s internal file entry names to determine the destination path on the server’s filesystem. An attacker can craft a malicious ZIP file where the filenames contain directory traversal sequences (e.g., “../../../public/index.php”). During the extraction process, the application concatenates this unsanitized path with the base extraction directory without checking if the final path remains within the intended target. This allows the attacker to overwrite arbitrary files anywhere the web server process has write permissions, potentially leading to remote code execution by replacing critical application files like Laravel controllers or configuration files.
DailyCVE Form:
Platform: Laravel Package
Version: <=3.3.1
Vulnerability: Path Traversal
Severity: High
date: 2025-12-04
Prediction: 2025-12-12
What Undercode Say:
zip -j payload.zip ../../../public/exploit.php curl -X POST -F "[email protected]" -H "X-CSRF-TOKEN: ..." $HOST/laravel-file-manager/upload
// Flawed extraction logic snippet $zip->extractTo($destinationPath); // Uses internal archive paths
How Exploit:
Craft malicious ZIP.
Upload to manager.
Trigger extraction.
File writes outside.
Protection from this CVE:
Update package version.
Implement path sanitization.
Restrict server permissions.
Impact:
Remote Code Execution.
Arbitrary File Overwrite.
System Compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
