Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-65346 — Technical write-up and proof-of-concept for CVE-2025-65346, an authenticated path traversal in laravel-file-manager v3.3.1 leading to arbitrary file write and potential RCE. | Kitploit
Tools/GitHubGitHub/theethat-thamwasin/cve-2025-65346
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & EducationPayload Development
GitHubtheethat-thamwasin/cve-2025-65346

CVE-2025-65346

Technical write-up and proof-of-concept for CVE-2025-65346, an authenticated path traversal in laravel-file-manager v3.3.1 leading to arbitrary file write and potential RCE.

View Repository
9 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-65346 – Authenticated Path Traversal From UnZip Function Leading to Arbitrary File Write in laravel-file-manager v3.3.1

🧭 Overview

A Path Traversal vulnerability in the unzip/extract functionality of the affected application allows an attacker to write files to arbitrary filesystem locations during archive extraction. Because the extraction routine fails to sanitize destination paths inside ZIP entries, an attacker can craft ZIP archives containing traversal sequences (e.g., ../../routes) or absolute paths. When processed by the application, these files are extracted directly to the specified locations with the permissions of the running process.

This flaw can be abused to overwrite existing files, plant executable payloads, or modify application behavior, potentially leading to remote code execution.

🧱 Affected Component

  • Project: laravel-file-manager
  • Component: zip/archiving Functionf
  • Affected version: v3.3.1 and below

🎯 Attack Vectors

  1. Attacker uploads or provides a ZIP archive to the application's unzip endpoint (authentication may or may not be required depending on configuration).
  • Manipulate the UNZIP request payload to include directory traversal sequences such as ../../routes.
  • The backend extraction logic resolves these paths without validation and writes files directly to those locations.
  • Existing files may be overwritten silently if filenames collide.
  • The attacker gains the ability to replace application files, write web shells, or modify critical configuration files.

    • 💥 Impact

    • Arbitrary File Write: Files can be written anywhere that is writable by the application user (e.g., www-data).
    • File Overwrite: Attackers can overwrite legitimate application files including routes, controllers, or configuration.
    • Remote Code Execution: By writing PHP, JSP, or other web-executable payloads into the webroot, the attacker can achieve full code execution.
    • Application Compromise: Modification of entry points, such as index.php, can alter site logic or introduce persistent backdoors.
    • Privilege Escalation (Indirect): Overwriting config/env files may expose secrets enabling further lateral movement.

    Severity: Critical

    Base Score: 9.1

    Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

    🛡️ Recommended Remediation

    • Implement canonical path validation: Normalize requested file paths and enforce a strict restriction to the project’s designated storage root.
    • Reject any path containing traversal sequences (../, %2e%2e/, nested traversal).
    • Apply server-side allowlist logic
    • Update to a patched version once the vendor releases a fix addressing this path traversal weakness.

    🙏 Credits

    Discovered and reported by: Theethat Thamwasin

    Download Tool