CVE-2025-65345

Executive Summary

CVE-2025-65345 is a Directory Traversal vulnerability in the alexusmai/laravel-file-manager package, version 3.3.1 and below. The vulnerability exists within the zip/archiving functionality, where improper path validation allows an attacker to create archives containing files and directories outside the intended scope. This can lead to unauthorized read/write access to sensitive files on the server, potentially enabling remote code execution or data exfiltration. The vulnerability is publicly known, but no official patch has been released as of this report.

Supply Chain & Package Security

This vulnerability affects the PHP package alexusmai/laravel-file-manager, distributed via Composer. Organizations using this package in their Laravel applications should treat this as a high-priority supply chain risk. The lack of a patch means that any application using version 3.3.1 or below is directly exploitable. Attackers can leverage this to compromise the integrity of the application and its underlying server.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the nature of the vulnerability (Directory Traversal in a file manager), the following is a reasonable assessment:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely via HTTP requests.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs at least user-level access to the file manager.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are in the same security authority.
• Confidentiality (C): High (H) – Sensitive files can be read.
• Integrity (I): High (H) – Files can be written or overwritten.
• Availability (A): Low (L) – Could potentially disrupt file system operations.

Estimated CVSS Score: 8.8 (High)

Threat Level: High. The vulnerability is easy to exploit, has public proof-of-concept, and no patch is available.

Deep Dive & Mechanics

The vulnerability resides in the zip/archiving functionality of alexusmai/laravel-file-manager. When a user creates a zip archive, the application does not properly sanitize or validate file paths. An attacker can craft a request that includes path traversal sequences (e.g., ../) in the file names or paths to be included in the archive. This allows the archive to contain files from outside the intended directory, such as /etc/passwd, application configuration files, or even web server source code.

The core issue is that the application likely uses a function like ZipArchive::addFile() or similar without checking if the resolved path is within the allowed base directory. By manipulating the path parameter or the file selection mechanism, an attacker can force the archive to include arbitrary files.

Attack Flow:

1. Attacker authenticates to the file manager (or exploits an unauthenticated endpoint if available).
2. Attacker sends a request to create a new archive, specifying files with path traversal sequences (e.g., ../../../etc/passwd).
3. The application creates a zip file containing the specified files, including those outside the intended scope.
4. Attacker downloads the archive and extracts the sensitive files.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern.

Vulnerable Code (Conceptual):

// Vulnerable: No path validation
$zip = new ZipArchive();
$zip->open($archivePath, ZipArchive::CREATE);
foreach ($files as $file) {
    // $file comes from user input, e.g., "../../../etc/passwd"
    $zip->addFile($file, basename($file));
}
$zip->close();

Patched Code (Conceptual):

// Patched: Validate and restrict paths
$basePath = realpath($allowedBaseDirectory);
$zip = new ZipArchive();
$zip->open($archivePath, ZipArchive::CREATE);
foreach ($files as $file) {
    $resolvedPath = realpath($file);
    // Ensure the resolved path starts with the base path
    if (strpos($resolvedPath, $basePath) === 0) {
        $zip->addFile($resolvedPath, basename($resolvedPath));
    } else {
        // Log or reject the file
        throw new Exception("Invalid file path: $file");
    }
}
$zip->close();

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A running instance of alexusmai/laravel-file-manager version 3.3.1 or below.
• Valid credentials for the file manager (or an unauthenticated endpoint).

Exploit Steps:

1. Authenticate to the file manager web interface.
2. Intercept the request to create a new archive (e.g., using Burp Suite).
3. Modify the request to include path traversal sequences in the file paths. For example:
   • Original: files[]=documents/report.pdf
   • Modified: files[]=../../../etc/passwd
4. Send the request and download the resulting archive.
5. Extract the archive to retrieve the sensitive file.

Example cURL Command:

curl -X POST -c cookies.txt -b cookies.txt \
  -F "action=zip" \
  -F "files[]=../../../etc/passwd" \
  -F "name=exploit.zip" \
  http://target.com/laravel-file-manager/zip

Blue Team (Defensive)

Detection:

• Monitor for requests to the file manager's zip endpoint containing path traversal sequences (../, ..\\, etc.).
• Look for unusual file names in archive creation requests (e.g., /etc/passwd, /var/www/html/.env).
• Alert on multiple failed attempts to access files outside the allowed directory.

Prevention:

• Immediately disable or restrict access to the zip/archiving functionality if possible.
• Implement a Web Application Firewall (WAF) rule to block path traversal patterns in file manager requests.
• Apply the principle of least privilege to the file manager's storage directory.
• Monitor logs for any successful exploitation attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /laravel-file-manager/zip or similar endpoints with parameters containing ../ or ..\\.
  • Outbound connections from the server to an attacker-controlled host (if the archive is exfiltrated).
• File System IOCs:
  • Unexpected zip files in the file manager's storage directory containing files from outside the allowed scope.
  • Presence of files like /etc/passwd or application configuration files in the archive.
• Log IOCs:
  • Application logs showing attempts to access files outside the base directory.
  • Web server logs (e.g., Apache/Nginx) showing requests with path traversal patterns.

Detection Engineering

YARA Rule

rule CVE_2025_65345_Directory_Traversal {
    meta:
        description = "Detects path traversal attempts in laravel-file-manager zip requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65345"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $zip_endpoint = "/zip"
        $file_manager = "laravel-file-manager"
    condition:
        any of ($traversal*) and $zip_endpoint and $file_manager
}

Sigma Rule

title: CVE-2025-65345 Directory Traversal in laravel-file-manager
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to exploit directory traversal in laravel-file-manager zip functionality
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '/laravel-file-manager/zip'
            - '/file-manager/zip'
        cs-uri-query|contains:
            - '../'
            - '..\\'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in file names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-65345 Directory Traversal in laravel-file-manager"; flow:to_server,established; content:"POST"; http_method; content:"/laravel-file-manager/zip"; http_uri; content:"../"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the zip/archiving functionality in the file manager configuration if possible.
2. Restrict access to the file manager to trusted IP addresses or VPN users.
3. Implement a WAF rule to block path traversal patterns.

Long-term Fix:

• Since no official patch is available, consider forking the repository and applying the path validation fix described in the "Vulnerable vs. Patched Code" section.
• Monitor the official repository for any security updates.
• Evaluate alternative file manager packages that are actively maintained and have a security track record.

Workaround:

• Modify the application code to validate that all file paths in archive creation requests resolve to within the allowed base directory.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert