Laravel File Manager vulnerabilities

2 known vulnerabilities in Laravel File Manager from Alexusmai. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  Laravel File Manager: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2025-65346Dec 4, 2025AlexusmaiEPSS 1.02%

  alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The unzip/extraction functionality improperly allows archive contents to be written to arbitrary locations on the filesystem due to insufficient validation of extraction paths

• 8.1 High severity

  Laravel File Manager: Improper Neutralization of Input During Web Page Generation

  CVE-2025-63307Nov 6, 2025Alexusmai

  alexusmai laravel-file-manager 3.3.1 is vulnerable to Cross Site Scripting (XSS). The application permits user-controlled upload, create, and rename of files to HTML and SVG types and serves those files inline without adequate content-type validation or output