CVE-2024-52306: FileManager Deserialization of Untrusted Data

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-13 · updated 2026-06-17
Weakness: CWE-502

Description

FileManager provides a Backpack admin interface for files and folder. Prior to 3.0.9, deserialization of untrusted data from the mimes parameter could lead to remote code execution. This vulnerability is fixed in 3.0.9.

Affected products

Laravel-Backpack FileManager: before 2.0.2; from 3.0.0 before 3.0.9 — fixed in 2.0.2, 3.0.9

How to fix

Upgrade to a fixed version: Laravel-Backpack FileManager 2.0.2, 3.0.9. Check the vendor advisory for mitigations.

References

https://github.com/Laravel-Backpack/FileManager/commit/2830498b85e05fb3c92179053b4d7c4a0fdb880b
https://github.com/Laravel-Backpack/FileManager/security/advisories/GHSA-8237-957h-h2c2

Get alerted when CVE-2024-52306 or the next vulnerability affects your stack