This affects versions of the package unisharp/laravel-filemanager before 2.6.2. The upload() function does not sufficiently validate the file type when uploading.
An attacker may be able to reproduce the following steps:
1. Install a package with a web Laravel application.
2. Navigate to the Upload window
3. Upload an image file, then capture the request
4. Edit the request contents with a malicious file (webshell)
5. Enter the path of file uploaded on URL - Remote Code Execution
**Note:** Prevention for bad extensions can be done by using a whitelist in the config file(lfm.php). Corresponding document can be found in [here](https://unisharp.github.io/laravel-filemanager/configfolder-categories).
References
Configurations
History
17 Jun 2025, 12:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| CWE | CWE-94 | |
| Summary | (en) This affects versions of the package unisharp/laravel-filemanager before 2.6.2. The upload() function does not sufficiently validate the file type when uploading. An attacker may be able to reproduce the following steps: 1. Install a package with a web Laravel application. 2. Navigate to the Upload window 3. Upload an image file, then capture the request 4. Edit the request contents with a malicious file (webshell) 5. Enter the path of file uploaded on URL - Remote Code Execution **Note:** Prevention for bad extensions can be done by using a whitelist in the config file(lfm.php). Corresponding document can be found in [here](https://unisharp.github.io/laravel-filemanager/configfolder-categories). |
21 Nov 2024, 05:51
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 6.5
v3 : 6.7 |
| References | () https://github.com/UniSharp/laravel-filemanager/blob/master/src/Controllers/UploadController.php%23L26 - Broken Link, Third Party Advisory | |
| References | () https://github.com/UniSharp/laravel-filemanager/issues/1113#issuecomment-1812092975 - | |
| References | () https://snyk.io/vuln/SNYK-PHP-UNISHARPLARAVELFILEMANAGER-1567199 - Third Party Advisory |
07 Dec 2023, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
04 Jan 2022, 14:01
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-434 | |
| References | (CONFIRM) https://snyk.io/vuln/SNYK-PHP-UNISHARPLARAVELFILEMANAGER-1567199 - Third Party Advisory | |
| References | (CONFIRM) https://github.com/UniSharp/laravel-filemanager/blob/master/src/Controllers/UploadController.php%23L26 - Broken Link, Third Party Advisory | |
| CPE | cpe:2.3:a:unisharp:laravel-filemanager:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : 6.5
v3 : 8.8 |
17 Dec 2021, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | This affects the package unisharp/laravel-filemanager from 0.0.0. The upload() function does not sufficiently validate the file type when uploading. An attacker may be able to reproduce the following steps: - Install a package with a web Laravel application. - Navigate to the Upload window - Upload an image file, then capture the request - Edit the request contents with a malicious file (webshell) - Enter the path of file uploaded on URL - Remote Code Execution **Note: Prevention for bad extensions can be done by using a whitelist in the config file(lfm.php). Corresponding document can be found in the [here](https://unisharp.github.io/laravel-filemanager/configfolder-categories). |
17 Dec 2021, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-12-17 20:15
Updated : 2025-06-17 12:15
NVD link : CVE-2021-23814
Mitre link : CVE-2021-23814
CVE.ORG link : CVE-2021-23814
JSON object : View
Products Affected
unisharp
- laravel-filemanager