Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!
CVE-2025-63307 — An authenticated Stored Cross-site Scripting (XSS) vulnerability in laravel-file-manager v3.3.1 and below allows attackers with access to the file manager interface to inject and persist arbitrary JavaScript code in uploaded or created files. | Kitploit
An authenticated Stored Cross-site Scripting (XSS) vulnerability in laravel-file-manager v3.3.1 and below allows attackers with access to the file manager interface to inject and persist arbitrary JavaScript code in uploaded or created files.
CVE-2025-63307 – Authenticated Stored Cross-site Scripting (XSS) in laravel-file-manager v3.3.1
🧭 Overview
An authenticated Stored Cross-site Scripting (XSS) vulnerability in laravel-file-manager v3.3.1 and below allows attackers with access to the file manager interface to inject and persist arbitrary JavaScript code in uploaded or created files.
By uploading a specially crafted .html or .svg file containing malicious JavaScript, or by directly creating and editing such a file within the file manager, attackers can achieve stored XSS that executes when any other authenticated user or administrator views the file through the web interface.
🧱 Affected Component
Project:laravel-file-manager
Component: File upload, create, and render functionality (e.g., FileManagerController.php)
Affected version:v3.3.1 and below
🎯 Attack Vectors
Authenticate with an account that has permission to upload, create, or rename files via the file manager interface.
Upload or create a file with a .svg or .html extension containing malicious JavaScript
The application stores this file without validating its content or sanitizing embedded scripts.
When another user (such as an administrator or repository maintainer) views or previews the file in their browser, the malicious JavaScript executes in the context of the application’s domain.
The script can then perform actions such as session hijacking, CSRF, or stealing sensitive data from the victim’s browser.
💥 Impact
Stored XSS: Persistent JavaScript execution within the application's origin.
Session Hijacking & Account Takeover: Attackers can steal cookies or perform actions as the victim.
Phishing / UI Redressing: Injected scripts can spoof UI elements or redirect users to malicious sites.
Sensitive Data Exposure: Access to information within the application accessible to the victim’s session.
theethat-thamwasin/cve-2025-63307
