CVE-2025-65345: alexusmai laravel-file-manager is vulnerable to Directory Traversal

December 3, 2025 (updated December 5, 2025)

alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The zip/archiving functionality allows an attacker to create archives containing files and directories outside the intended scope due to improper path validation.

References

github.com/advisories/GHSA-rr44-8j7r-jg2q
github.com/alexusmai/laravel-file-manager
github.com/tlekrean/CVE-2025-65345
nvd.nist.gov/vuln/detail/CVE-2025-65345

Code Behaviors & Features

Detect and mitigate CVE-2025-65345 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →