Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2024-21546 EUVD-2024-3559GHSA-6569-3785-r3v6

UniSharp Laravel Filemanager Code Injection vulnerability

Published Dec 18, 2024 · Updated Aug 28, 2025 · Assigned by snyk

Package: unisharp/laravel-filemanager Ecosystem: Packagist

Description

Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimetype and inserting the . character after the php file extension. This allows the attacker to execute malicious code.

Affected products

VendorProductAffectedFixed
— unisharp/laravel-filemanager < 2.9.1 2.9.1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

  • ajdumanhug/CVE-2024-21546 ★ 5 · May 5, 2025

    This Python exploit script targets a vulnerable Laravel Filemanager created by UniSharp, which allows authenticated users to bypass file restrictions and upload malicious files. This can lead to Remo…

  • digitalsurgn/CVE-2024-21546 ★ 0 · Sep 3, 2026

    This repository contains security assessment tooling, detection templates, and an automated exploit toolkit for identifying and exploiting Unauthenticated Remote Code Execution (RCE) in applications …

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist unisharp/laravel-filemanager < 2.9.1 2.9.1 GHSA-6569-3785-r3v6

References