im-hanzou/cve-2025-56399CVE-2025-56399 – Remote Code Execution in laravel-file-manager v3.3.1. Exploits misconfigured config in Laravel File Manager to upload and verify a PHP shell via unauthenticated file upload.
CVE-2025-56399 – Remote Code Execution in laravel-file-manager v3.3.1. Exploits misconfigured config in Laravel File Manager to upload and verify a PHP shell via unauthenticated file upload.
Download repository
git clone https://github.com/im-hanzou/CVE-2025-56399
Go to repository folder
cd CVE-2025-56399
Install requirements
pip install -r requirements.txt
Prepare a targets.txt file, one target per line:
https://example.com
192.168.1.1:8080
Run:
python CVE-2025-56399.py
Results are saved to:
vulnerable.txt — targets with exposed file manageruploaded.txt — shell URLs with status [CONFIRMED] / [UPLOADED] / [UNVERIFIED]This tool is for educational and authorized security research purposes only. The author is not responsible for any misuse or damage caused by this tool. Only use against systems you own or have explicit permission to test.