Loading vulnerability…
alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The zip/archiving functionality allows an attacker to create archives containing files and directories outside the intended scope due to improper path validation.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository documents a proof-of-concept (PoC) exploit for CVE-2025-65345, a path traversal vulnerability in laravel-file-manager v3.3.1 and below. The exploit allows an authenticated user to abuse the ZIP/archiving function by manipulating the HTTP request (specifically the 'directories' parameter) to include path traversal sequences. This results in the backend zipping files and directories outside the intended scope, such as /var/www or /etc/passwd, and making them available for download via the file manager interface. The repository contains two markdown files: POC-CVE-65345.md, which provides a detailed step-by-step exploitation guide with screenshots, and README.md, which summarizes the vulnerability, impact, and remediation recommendations. There is no executable code; the PoC is procedural and relies on manual HTTP request manipulation using tools like Burp Suite. The main exploit capability is arbitrary file disclosure on the server filesystem, potentially leading to further compromise. No network endpoints or IP addresses are hardcoded; the only fingerprintable endpoints are example file paths used in the attack.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
1 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.