CVE-2025-65346 – Authenticated Path Traversal From UnZip Function Leading to Arbitrary File Write in laravel-file-manager v3.3.1

🧭 Overview

A Path Traversal vulnerability in the unzip/extract functionality of the affected application allows an attacker to write files to arbitrary filesystem locations during archive extraction. Because the extraction routine fails to sanitize destination paths inside ZIP entries, an attacker can craft ZIP archives containing traversal sequences (e.g., ../../routes) or absolute paths. When processed by the application, these files are extracted directly to the specified locations with the permissions of the running process.

This flaw can be abused to overwrite existing files, plant executable payloads, or modify application behavior, potentially leading to remote code execution.

🧱 Affected Component

• Project: laravel-file-manager
• Component: zip/archiving Functionf
• Affected version: v3.3.1 and below

🎯 Attack Vectors

1. Attacker uploads or provides a ZIP archive to the application's unzip endpoint (authentication may or may not be required depending on configuration).
2. Manipulate the UNZIP request payload to include directory traversal sequences such as ../../routes.
3. The backend extraction logic resolves these paths without validation and writes files directly to those locations.
4. Existing files may be overwritten silently if filenames collide.
5. The attacker gains the ability to replace application files, write web shells, or modify critical configuration files.

💥 Impact

• Arbitrary File Write: Files can be written anywhere that is writable by the application user (e.g., www-data).
• File Overwrite: Attackers can overwrite legitimate application files including routes, controllers, or configuration.
• Remote Code Execution: By writing PHP, JSP, or other web-executable payloads into the webroot, the attacker can achieve full code execution.
• Application Compromise: Modification of entry points, such as index.php, can alter site logic or introduce persistent backdoors.
• Privilege Escalation (Indirect): Overwriting config/env files may expose secrets enabling further lateral movement.

Severity: Critical

Base Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

🛡️ Recommended Remediation

• Implement canonical path validation: Normalize requested file paths and enforce a strict restriction to the project’s designated storage root.
• Reject any path containing traversal sequences (../, %2e%2e/, nested traversal).
• Apply server-side allowlist logic
• Update to a patched version once the vendor releases a fix addressing this path traversal weakness.

🙏 Credits

Discovered and reported by: Theethat Thamwasin

---