PT-2025-45330 · Git+1 · Laravel-File-Manager

Published 2025-11-06 · Updated 2025-11-06 · CVE-2025-63307

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions alexusmai laravel-file-manager version 3.3.1

Description Cross Site Scripting (XSS) occurs because the application allows users to upload, create, and rename files as HTML and SVG types. These files are served inline without sufficient output sanitization or content-type validation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-63307

Affected Products

Laravel-File-Manager

References · 5

• 🔥 https://github.com/Theethat-Thamwasin/CVE-2025-63307 · Exploit
• 🔥 https://github.com/Theethat-Thamwasin/CVE-2025-63307/blob/main/POC-CVE-63307.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-63307 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-63307 · Security Note
• https://github.com/alexusmai/laravel-file-manager · Note