Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.Test your applications
16 Dec 2021
18 Aug 2021
How to fix?
unisharp/laravel-filemanager to version 2.5.1 or higher.
unisharp/laravel-filemanager is an A file upload/editor intended for use with Laravel 5 to 6 and CKEditor / TinyMCE.
Affected versions of this package are vulnerable to Arbitrary File Upload. The
upload() function does not sufficiently validate the file type when uploading.
An attacker may be able to reproduce the following steps:
- Install a package with a web Laravel application.
- Navigate to the
- Upload an image file, then capture the request
- Edit the request contents with a malicious file (webshell)
- Enter the path of file uploaded on URL - Remote Code Execution
**Note: Prevention for bad extensions can be done by using a whitelist in the config file(
lfm.php). Corresponding document can be found in the here.