PT-2025-44188 · Unknown · Laravel-File-Manager

Published 2025-10-28 · Updated 2025-10-29 · CVE-2025-56399

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions laravel-file-manager versions 3.3.1 and before

Description An authenticated attacker can achieve Remote Code Execution (RCE) by uploading a crafted file. A file with a '.png' extension containing PHP code can be uploaded through the file manager interface. While client-side validation may indicate upload failure, the file is saved on the server. The attacker can then use the rename API to change the file extension to '.php', and accessing it via a public URL results in server-side code execution. The vulnerable API endpoint used for renaming is not specified. The vulnerable parameter used for file upload is not specified.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-56399

Affected Products

Laravel-File-Manager

References · 6

• 🔥 https://github.com/Theethat-Thamwasin/CVE-2025-56399 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-56399 · Security Note
• https://t.me/cveNotify/140830 · Telegram Post
• https://t.me/CVEtracker/35977 · Telegram Post
• http://laravel-file-manager.com · Note
• https://twitter.com/CVEnew/status/1983198081223905409 · Twitter Post