Loading story…
Two high-severity file upload vulnerabilities have been disclosed in Laravel ecosystem components used for content and file management. Sharp versions prior to 9.20.0 are affected by CVE-2026-33687, which lets authenticated users bypass upload restrictions by tampering with a client-controlled validation_rule parameter so the server accepts files without intended MIME type or extension checks. The issue was fixed in 9.20.0 by removing client-side control over validation and enforcing checks server-side; the advisory also notes risk is reduced when uploads are stored on a strictly private disk and that default setups do not directly execute uploaded PHP files unless a public disk is configured.
A separate disclosure, CVE-2019-25673, affects UniSharp Laravel File Manager v2.0.0-alpha7 and v2.0, where authenticated attackers can submit multipart uploads with the type parameter set to Files, upload malicious PHP content, and then trigger arbitrary code execution by accessing the uploaded file from the working directory path. Both issues are classified as CWE-434 unrestricted file upload flaws and carry high-impact severity scores, underscoring the risk that authenticated upload features in Laravel-based management tools can be abused to place attacker-controlled files on servers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A CVE entry for an arbitrary file upload vulnerability in UniSharp Laravel File Manager v2.0.0-alpha7 and v2.0 was received by disclosure@vulncheck.com. The flaw allows authenticated attackers to upload malicious PHP files via the upload endpoint and achieve code execution by accessing the uploaded file.
Sharp addressed CVE-2026-33687 in version 9.20.0 by removing client-controlled validation rules and enforcing upload validation on the server side. The advisory also noted that using a strictly private storage disk reduces risk.
CVE-2026-33687 was recorded for Sharp, a Laravel-packaged content management framework, affecting versions prior to 9.20.0. The issue lets authenticated users bypass file type restrictions by manipulating the client-controlled validation_rule parameter in upload requests.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability in **Livewire Filemanager**, a file-management component used in **Laravel** web applications, allows **unauthenticated remote code execution** via malicious file upload. Tracked as **CVE-2025-14894** (CERT/CC note **VU#650657**; reported **CVSS 7.5**), the issue stems from inadequate file-type and MIME validation in `LivewireFilemanagerComponent.php`, enabling attackers to upload a PHP payload (e.g., a webshell) through the component’s upload interface. Exploitation is straightforward in common Laravel deployments: if the application exposes uploaded content through the public `/storage/` path—typically after running the standard setup command `php artisan storage:link`—an attacker can upload a malicious PHP file and then trigger execution by requesting it via the storage URL. Successful exploitation runs code with the privileges of the web server user, enabling broad read/write access to accessible files and potential pivoting to connected systems; at the time of reporting, the issue was described as **unpatched/unacknowledged by the vendor**, with the project’s documentation reportedly treating file validation as “out of scope” for the component itself.
Jun 29, 2026
Chamilo LMS disclosed high-severity unrestricted file upload vulnerabilities, `CVE-2023-4225` and `CVE-2023-4226`, in `/main/inc/ajax/exercise.ajax.php` and `/main/inc/ajax/work.ajax.php`. The flaws affect versions up to and including `1.11.24` and allow an authenticated user with learner privileges to upload arbitrary files into the web-accessible `/app/cache` directory. By uploading PHP files and modifying `.htaccess`, an attacker can enable code execution on the server and run commands with the web server's privileges; STAR Labs demonstrated exploitation with a PHP web shell executing as `www-data`. The advisories said the vulnerable logic trusted user-supplied filenames without adequate restriction and noted similar issues in related Chamilo AJAX handlers tracked as `CVE-2023-4223` and `CVE-2023-4224`. Beyond remote code execution, the same weakness can also support stored cross-site scripting through uploaded HTML content. Chamilo addressed the issues in version `1.11.26`, and defenders were urged to review requests to the affected endpoints and access to `/app/cache` for signs of compromise.
Jun 29, 2026
Chamilo LMS fixed multiple high-severity file upload vulnerabilities that allowed attackers to achieve remote code execution by abusing weak filename validation and unsafe handling of uploaded files. In `CVE-2023-3545`, affecting versions through `1.11.20`, improper case-sensitive sanitization in `fileUpload.lib.php` let attackers on Windows servers running Apache bypass `.htaccess` upload protections with mixed-case filenames, then configure Apache to execute uploaded files as PHP. STAR Labs said the flaw could be exploited by authenticated users with the Trainer role or chained with an arbitrary file write bug such as `CVE-2023-3533` for unauthenticated compromise; Chamilo fully addressed it in version `1.11.22`. A separate flaw, `CVE-2023-4223`, affected versions through `1.11.24` in `/main/inc/ajax/document.ajax.php` and allowed an authenticated learner to upload PHP files and overwrite `.htaccess` in the web-accessible `/app/cache` directory, leading to remote code execution and stored cross-site scripting. STAR Labs reported that user-controlled filenames were written into `SYS_ARCHIVE_PATH` without sufficient validation or dangerous file-type restrictions, and noted similar upload issues in related AJAX handlers tracked as `CVE-2023-4224`, `CVE-2023-4225`, and `CVE-2023-4226`. Chamilo released a complete fix for `CVE-2023-4223` in version `1.11.26`.
Jun 29, 2026