laravel-file-manager vulnerabilities

alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The zip/archiving functionality allows an attacker to create archives containing files and directories outside the intended scope due to improper path validation.

alexusmai laravel-file-manager 3.3.1 is vulnerable to Cross Site Scripting (XSS). The application permits user-controlled upload, create, and rename of files to HTML and SVG types and serves those files inline without adequate content-type validation or output sanitization.

In laravel-file-manager version 3.3.1 and earlier, an authenticated attacker can upload a .png file containing PHP code, which despite client-side validation failure is saved on the server. Using the rename API, the attacker changes the extension to .php, enabling remote code execution (RCE).