Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-56399 — An authenticated Remote Code Execution (RCE) vulnerability in laravel-file-manager v3.3.1 and below allows attackers with access to the file manager interface to execute arbitrary code on the server. | Kitploit
Tools/GitHubGitHub/theethat-thamwasin/cve-2025-56399
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingPapers & ResearchLearning & Education
GitHubtheethat-thamwasin/cve-2025-56399

CVE-2025-56399

An authenticated Remote Code Execution (RCE) vulnerability in laravel-file-manager v3.3.1 and below allows attackers with access to the file manager interface to execute arbitrary code on the server.

View Repository
3210 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-56399 – Authenticated Remote Code Execution in laravel-file-manager v3.3.1

🧭 Overview

An authenticated Remote Code Execution (RCE) vulnerability in laravel-file-manager v3.3.1 and below allows attackers with access to the file manager interface to execute arbitrary code on the server. By uploading a file with a permitted non-PHP extension (e.g., .png, .pdf) containing malicious PHP code and renaming it to a .php extension, or by directly creating and editing a .php file, attackers can achieve RCE when the file is accessed via a public URL.

🧱 Affected Component

  • Project: laravel-file-manager
  • Component: File upload / rename API
  • Affected version: v3.3.1 and below

🎯 Attack Vectors

  1. Authenticate with an account that has access to the file manager’s upload or create file functionality.
  2. Upload a file (e.g., shell.png) containing malicious PHP code (e.g., ) via the file manager’s upload interface or API.
  • Use the rename API or interface to change the file extension from shell.png to shell.php.
  • Access the file at a public URL (e.g., https://server-ip-address/storage/shell.php?c=id) to execute the PHP payload.
  • Alternatively, use the "Create File" function to create a file (e.g., shell.php), then use the edit function to insert malicious PHP code and access it via a public URL.

    • 💥 Impact

    • Remote Code Execution (RCE): Attackers can execute arbitrary commands in the web server’s context.
    • System Compromise: Depending on server configuration, this could lead to full compromise of the web application and host system.
    • Critical Risk: High impact on confidentiality, integrity, and availability of the affected system.

    CVSS v3

    Base Score: 8.8

    Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

    Severity: High

    🛡️ Recommended Remediation

    • Implement server-side validation of file MIME types and magic bytes to ensure uploaded files match their extensions.
    • Enforce a strict whitelist of allowed file extensions and reject executable extensions like .php.
    • Restrict file renaming to prevent changing to executable extensions without additional validation.
    • Disable script/PHP execution in upload directories.

    🙏 Credits

    Discovered and reported by: Chayawat Jeamprasertboon, Thanakorn Boontem, Theethat Thamwasin

    Download Tool