PT-2021-15554 · Unknown · Unisharp/Laravel-Filemanager

Huy Nguyen

·

Published

2021-12-17

·

Updated

2025-06-17

·

CVE-2021-23814

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: unisharp/laravel-filemanager versions prior to 2.6.2
Description: The issue arises from insufficient validation of file types during the upload process, specifically in the upload() function. This allows an attacker to potentially upload malicious files, such as webshells, by capturing and editing the upload request. The exploitation steps include installing the package with a web Laravel application, navigating to the upload window, uploading an image file, capturing the request, editing it to include a malicious file, and then accessing the uploaded file's path to achieve remote code execution. Prevention can be achieved by using a whitelist in the config file (lfm.php), with documentation available.
Recommendations: For versions prior to 2.6.2, update to version 2.6.2 or later to resolve the issue. As a temporary workaround, consider using a whitelist in the config file (lfm.php) to prevent bad extensions until a patch is applied. Restrict access to the upload functionality to minimize the risk of exploitation.

Fix

RCE

Unrestricted File Upload

Code Injection

Weakness Enumeration

Related Identifiers

CVE-2021-23814
GHSA-F8X6-M9F5-FFP8
SNYK-PHP-UNISHARPLARAVELFILEMANAGER-1567199

Affected Products

Unisharp/Laravel-Filemanager