CVE-2025-56399 – Authenticated Remote Code Execution in laravel-file-manager v3.3.1

🧭 Overview

An authenticated Remote Code Execution (RCE) vulnerability in laravel-file-manager v3.3.1 and below allows attackers with access to the file manager interface to execute arbitrary code on the server. By uploading a file with a permitted non-PHP extension (e.g., .png, .pdf) containing malicious PHP code and renaming it to a .php extension, or by directly creating and editing a .php file, attackers can achieve RCE when the file is accessed via a public URL.

🧱 Affected Component

• Project: laravel-file-manager
• Component: File upload / rename API
• Affected version: v3.3.1 and below

🎯 Attack Vectors

1. Authenticate with an account that has access to the file manager’s upload or create file functionality.
2. Upload a file (e.g., shell.png) containing malicious PHP code (e.g., ) via the file manager’s upload interface or API.
3. Use the rename API or interface to change the file extension from shell.png to shell.php.
4. Access the file at a public URL (e.g., https://server-ip-address/storage/shell.php?c=id) to execute the PHP payload.
5. Alternatively, use the "Create File" function to create a file (e.g., shell.php), then use the edit function to insert malicious PHP code and access it via a public URL.

💥 Impact

• Remote Code Execution (RCE): Attackers can execute arbitrary commands in the web server’s context.
• System Compromise: Depending on server configuration, this could lead to full compromise of the web application and host system.
• Critical Risk: High impact on confidentiality, integrity, and availability of the affected system.

CVSS v3

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Severity: High

🛡️ Recommended Remediation

• Implement server-side validation of file MIME types and magic bytes to ensure uploaded files match their extensions.
• Enforce a strict whitelist of allowed file extensions and reject executable extensions like .php.
• Restrict file renaming to prevent changing to executable extensions without additional validation.
• Disable script/PHP execution in upload directories.

🙏 Credits

Discovered and reported by: Chayawat Jeamprasertboon, Thanakorn Boontem, Theethat Thamwasin

---