Listen to this Post
The CVE-2025-65346 vulnerability is a Directory Traversal flaw in the `unzip` functionality of the alexusmai/laravel-file-manager package (versions 3.3.1 and below). It occurs because the application does not properly validate or sanitize the file paths extracted from a user-supplied ZIP archive. An attacker can craft a malicious archive containing files with relative path sequences (like ../../../etc/passwd). During the extraction process, the application uses these unsanitized paths to determine the write location on the server’s filesystem. This allows the archive contents to be written outside the intended, safe extraction directory. Consequently, an attacker can overwrite or create arbitrary files anywhere the web server process has write permissions. This can lead to remote code execution by writing a malicious web shell, disruption of service by overwriting critical system files, or unauthorized access to sensitive data.
DailyCVE Form
Platform: Laravel File Manager
Version: 3.3.1 below
Vulnerability: Directory Traversal
Severity: Critical
Date: 2025-12-04
Prediction: 2026-01-15
What Undercode Say
`$ zip exploit.zip ../../../public/html/shell.php`
`$ curl -X POST -F “[email protected]” /laravel-file-manager/unzip`
`// Example of vulnerable path handling code snippet:`
`// $destinationPath = $request->input(‘path’); // User-controlled`
`// $zip->extractTo($destinationPath); // No traversal sanitization`
How Exploit
- Attacker crafts a ZIP file with a PHP web shell, using `../` sequences to target a web-accessible directory.
- Attacker uploads the ZIP via the file manager’s unzip functionality.
- The vulnerable code extracts the archive, writing the shell to the calculated path (e.g.,
/var/www/html/shell.php). - Attacker accesses the uploaded shell via browser, gaining command execution on the server.
Protection from this CVE
Immediate Actions: Update package to patched version. Temporary Mitigation: Disable unzip feature. Code Fix: Implement strict path sanitization, resolving all `..` sequences and confining extraction to a safe, pre-defined base directory.
Impact
Critical severity. Leads to arbitrary file write, enabling remote code execution (RCE), complete system compromise, data theft, or service disruption.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
