CVE CVE-2019-25673

CVE-2019-25673

PHPLaravel

Severity: HIGH
CVSS: 8.8CVSS
Published: 2026-04-05
Last modified: 2026-04-05
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-434

Description

UniSharp Laravel File Manager v2.0.0-alpha7 and v2.0 contain an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by sending multipart form data to the upload endpoint. Attackers can upload PHP files with the type parameter set to Files and execute arbitrary code by accessing the uploaded file through the working directory path.

References

https://github.com/UniSharp/laravel-filemanager
https://github.com/UniSharp/laravel-filemanager/issues/356
https://www.exploit-db.com/exploits/46389
https://www.vulncheck.com/advisories/unisharp-laravel-file-manager-alpha7-arbitrary-file-upload

Summary

Description

References