Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

Laravel Filemanager versions before 2.9.1 allow attackers to run malicious code

CVE-2024-21546 · published 1 year ago
Summary

Old versions of the Laravel Filemanager package are vulnerable to a type of attack called Remote Code Execution. This means that a hacker could potentially run malicious code on your website, which could lead to unauthorized access or data theft. Update to version 2.9.1 or later to fix this issue and protect your site.

What to do
  • Update unisharp laravel-filemanager to version 2.9.1.
Affected software
Ecosystem VendorProductAffected versions
composer unisharp laravel-filemanager < 2.9.1
Fix: upgrade to 2.9.1
Original advisory text
Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimetype and inserting the . character after the php file exten...
Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimetype and inserting the . character after the php file extension. This allows the attacker to execute malicious code.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.9 Critical
Exploitation
1% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published18 Dec 2024
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-6569-3785-r3v6 · GHSA
CVE-2024-21546 · NVD
CVE-2024-21546 · OSV
Track software like this
Free during beta