Skip to content
OpenAdvisories
High · 8.8 Public exploit CVE-2025-56399 EUVD-2025-36538GHSA-rhx3-j9rv-vfqm

alexusmai laravel-file-manager 3.3.1 and before allows an authenticated attacker to achieve Remote Code Execution (RCE) through a crafted f…

Published Oct 28, 2025 · Updated Aug 5, 2026 · Assigned by mitre

Description

alexusmai laravel-file-manager 3.3.1 and before allows an authenticated attacker to achieve Remote Code Execution (RCE) through a crafted file upload. A file with a '.png` extension containing PHP code can be uploaded via the file manager interface. Although the upload appears to fail client-side validation, the file is still saved on the server. The attacker can then use the rename API to change the file extension to `.php`, and upon accessing it via a public URL, the server executes the embedded code.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 3 repositories

  • Theethat-Thamwasin/CVE-2025-56399 ★ 3 · Sep 24, 2025

    An authenticated Remote Code Execution (RCE) vulnerability in laravel-file-manager v3.3.1 and below allows attackers with access to the file manager interface to execute arbitrary code on the server.

  • Jenderal92/laravel-filemanager-unrestricted-upload ★ 2 · Jun 28, 2026

    PoC for CVE-2025-56399 - Unrestricted File Upload leading to RCE in alexusmai/laravel-file-manager (≤3.3.1). Automates detection, CSRF extraction, and File Upload

  • im-hanzou/CVE-2025-56399 ★ 1 · Mar 8, 2026

    CVE-2025-56399 – Remote Code Execution in laravel-file-manager v3.3.1. Exploits misconfigured config in Laravel File Manager to upload and verify a PHP shell via unauthenticated file upload.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References