PT-2025-44188 · Unknown · Laravel-File-Manager

CVE-2025-56399 · Published 2025-10-28 · Updated 2026-06-29

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions alexusmai laravel-file-manager versions prior to 3.3.2

Description An authenticated attacker can achieve Remote Code Execution (RCE) through a two-step process involving a crafted file upload. First, a file with a .png extension containing PHP code is uploaded via the file manager interface; despite appearing to fail client-side validation, the file is saved on the server. Second, the attacker uses the rename API to change the file extension to .php. Accessing the file via a public URL then triggers the server to execute the embedded code.

Recommendations Update alexusmai laravel-file-manager to a version newer than 3.3.1. Restrict access to the rename API to minimize the risk of exploitation.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-56399

Affected Products

Laravel-File-Manager

References · 8

• 🔥 https://github.com/Theethat-Thamwasin/CVE-2025-56399 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-56399 · Security Note
• https://twitter.com/YogSoth0/status/2071191851109945616 · Twitter Post
• https://t.me/CVEtracker/35977 · Telegram Post
• https://t.me/cveNotify/140830 · Telegram Post
• https://twitter.com/UndercodeUpdate/status/2071503588094861770 · Twitter Post
• http://laravel-file-manager.com · Note
• https://twitter.com/CVEnew/status/1983198081223905409 · Twitter Post