CVE-2025-63307
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
alexusmai laravel-file-manager 3.3.1 is vulnerable to Cross Site Scripting (XSS). The application permits user-controlled upload, create, and rename of files to HTML and SVG types and serves those files inline without adequate content-type validation or output sanitization.
Risk Assessment
An attacker can inject malicious JavaScript that executes in a victim's browser, potentially leading to session theft or credential disclosure.
Recommendation
Update the library to a patched version or implement additional validation and sanitization of uploaded files.
Other vulnerabilities in laravel-file-manager
See all- CVE-2025-65345Medium
alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The zip/archiving functionality allows an attacker to create archives containing files and directories outside the intended scope due to improper path validation.
- CVE-2025-56399High
In laravel-file-manager version 3.3.1 and earlier, an authenticated attacker can upload a .png file containing PHP code, which despite client-side validation failure is saved on the server. Using the rename API, the attacker changes the extension to .php, enabling remote code execution (RCE).
Original NVD description (English source)
alexusmai laravel-file-manager 3.3.1 is vulnerable to Cross Site Scripting (XSS). The application permits user-controlled upload, create, and rename of files to HTML and SVG types and serves those files inline without adequate content-type validation or output sanitization.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS