CVE-2025-65346

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-12-04 · updated 2026-06-17
Weakness: CWE-22

Description

alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The unzip/extraction functionality improperly allows archive contents to be written to arbitrary locations on the filesystem due to insufficient validation of extraction paths.

Affected products

Alexusmai Laravel File Manager: through 3.3.1

References

https://github.com/Theethat-Thamwasin/CVE-2025-65346
https://github.com/alexusmai/laravel-file-manager
https://github.com/Theethat-Thamwasin/CVE-2025-65346/blob/main/POC-CVE-65346.md

Get alerted when CVE-2025-65346 or the next vulnerability affects your stack