CVE-2025-65345

48th percentile - higher than 48% of all known CVEs

alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The zip/archiving functionality allows an attacker to create archives containing files and directories outside the intended scope due to improper path validation.

An attacker could read or write files outside the intended directory, potentially leading to data leakage or overwriting system files. The risk depends on the application process privileges.

Update laravel-file-manager to a version containing the fix. Enforce strict path validation when creating archives and limit filesystem permissions for the application.