Loading story…
Researchers disclosed multiple high-severity vulnerabilities in the open-source Voyager admin package for Laravel, warning that flaws in versions 1.8.0 and earlier can be chained to achieve remote code execution and potentially full system compromise. The reported issues include CVE-2024-55417, an arbitrary file upload weakness caused by insufficient MIME-type validation, and CVE-2024-55416, a reflected XSS flaw in the /admin/compass component that can help attackers reach code execution in administrative contexts.
The disclosures also describe a file path manipulation issue that can enable unauthorized file read and deletion, expanding the impact beyond code execution to broader application and server compromise. Public reporting said no security update was available at the time of notice, and defenders were urged to treat Voyager deployments as exposed, restrict or avoid use of the package until patches are released, and assess Laravel environments for signs of malicious uploads, admin-panel abuse, and tampering with application files.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CSIRT.SK issued an alert about the high-severity Voyager vulnerabilities and stated that no security updates were available at the time. It recommended avoiding use of the package until patches are released.
SonarSource published research detailing three vulnerabilities in the Voyager Laravel admin package, including arbitrary file upload, reflected XSS, and file path manipulation. The report said CVE-2024-55417 and CVE-2024-55416 could be chained for remote code execution affecting Voyager versions up to 1.8.0.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity file upload vulnerabilities have been disclosed in Laravel ecosystem components used for content and file management. **Sharp** versions prior to `9.20.0` are affected by `CVE-2026-33687`, which lets authenticated users bypass upload restrictions by tampering with a client-controlled `validation_rule` parameter so the server accepts files without intended MIME type or extension checks. The issue was fixed in `9.20.0` by removing client-side control over validation and enforcing checks server-side; the advisory also notes risk is reduced when uploads are stored on a strictly private disk and that default setups do not directly execute uploaded PHP files unless a public disk is configured. A separate disclosure, `CVE-2019-25673`, affects **UniSharp Laravel File Manager** `v2.0.0-alpha7` and `v2.0`, where authenticated attackers can submit multipart uploads with the `type` parameter set to `Files`, upload malicious PHP content, and then trigger **arbitrary code execution** by accessing the uploaded file from the working directory path. Both issues are classified as `CWE-434` unrestricted file upload flaws and carry high-impact severity scores, underscoring the risk that authenticated upload features in Laravel-based management tools can be abused to place attacker-controlled files on servers.
Jun 29, 2026
A high-severity vulnerability in **Livewire Filemanager**, a file-management component used in **Laravel** web applications, allows **unauthenticated remote code execution** via malicious file upload. Tracked as **CVE-2025-14894** (CERT/CC note **VU#650657**; reported **CVSS 7.5**), the issue stems from inadequate file-type and MIME validation in `LivewireFilemanagerComponent.php`, enabling attackers to upload a PHP payload (e.g., a webshell) through the component’s upload interface. Exploitation is straightforward in common Laravel deployments: if the application exposes uploaded content through the public `/storage/` path—typically after running the standard setup command `php artisan storage:link`—an attacker can upload a malicious PHP file and then trigger execution by requesting it via the storage URL. Successful exploitation runs code with the privileges of the web server user, enabling broad read/write access to accessible files and potential pivoting to connected systems; at the time of reporting, the issue was described as **unpatched/unacknowledged by the vendor**, with the project’s documentation reportedly treating file validation as “out of scope” for the component itself.
Jun 29, 2026
A series of critical vulnerabilities have been disclosed affecting a wide range of popular software platforms, including WordPress plugins, web frameworks, developer tools, and enterprise applications. Notable issues include unauthenticated remote code execution (RCE) flaws in Next.js (CVE-2025-66478), WordPress core (CVE-2025-6389), and the ACF Extended plugin (CVE-2025-13486), as well as privilege escalation and authentication bypass vulnerabilities in the WP Directory Kit plugin (CVE-2025-13390) and cPanel. Several of these vulnerabilities are reported to be under active exploitation, with proof-of-concept code available for some, increasing the urgency for immediate patching and mitigation. Other significant disclosures include a high-severity flaw in Vim for Windows (CVE-2025-66476) allowing arbitrary code execution, a critical SQL injection chain in Synology BeeStation, and a directory traversal vulnerability in cPanel that could lead to full server takeover. Additional advisories cover issues in lz4-java, Longwatch OT surveillance, Django, Elementor, Apache Struts, nopCommerce, and OpenVPN, with many rated as critical or high severity by CVSS. Organizations are strongly advised to review affected products and apply security updates promptly to mitigate the risk of exploitation.
Jun 29, 2026