What is the CVSS score of CVE-2025-56399?

CVE-2025-56399 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Laravel File Manager are affected by CVE-2025-56399?

Laravel File Manager (versions 3.3.1 and earlier) contains a remote code execution vulnerability allowing authenticated file-upload users to execute arbitrary PHP code on affected servers by…

How to fix or mitigate CVE-2025-56399?

Within 24 hours: Audit all production web applications to identify systems using alexusmai laravel-file-manager versions 3.3.1 or earlier; restrict file-upload functionality to fully-trusted administrative accounts only if operationally feasible. Within 7 days: Monitor the official alexusmai/laravel-file-manager GitHub repository for security advisory and patch release; prepare upgrade plan targeting version 3.3.2 or later once released, or evaluate alternative file-management solutions. Within 30 days: Execute upgrade or component replacement across all affected production and staging systems.

Laravel File Manager CVE-2025-56399

HIGH

Code Injection (CWE-94)

2025-10-28 cve@mitre.org

Code Injection PHP File Upload RCE

8.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable APIs and simple HTTP steps give AV:N/AC:L; a valid file-manager account is required so PR:L, and full RCE yields C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 03:09 vuln.today

DescriptionCVE.org

alexusmai laravel-file-manager 3.3.1 and before allows an authenticated attacker to achieve Remote Code Execution (RCE) through a crafted file upload. A file with a '.png extension containing PHP code can be uploaded via the file manager interface. Although the upload appears to fail client-side validation, the file is still saved on the server. The attacker can then use the rename API to change the file extension to .php`, and upon accessing it via a public URL, the server executes the embedded code.

AnalysisAI

Remote code execution in alexusmai laravel-file-manager (versions 3.3.1 and earlier) lets an authenticated user with file-manager access run arbitrary PHP on the server by uploading a PHP payload disguised with a .png extension, then abusing the rename API to give it a .php extension so it executes when requested via a public URL. The flaw stems from client-side-only upload validation combined with an unrestricted rename operation and web-accessible storage. No CISA KEV listing; EPSS is a modest 0.55% (42nd percentile), but a dedicated GitHub repository referencing this CVE indicates public proof-of-concept material likely exists.

Technical ContextAI

alexusmai/laravel-file-manager is a Composer package that adds a Vue.js-based file browser and upload/rename/delete API to Laravel applications, typically exposing a storage disk over HTTP. The root cause is CWE-94 (Code Injection): upload restrictions are enforced only in the client-side JavaScript, so a server-side path still persists the file even after the browser reports a validation failure. Because the package also exposes a rename endpoint that does not restrict target extensions, and uploaded content is stored in a directory served directly by the web server, an operator can convert an image-named payload into an executable .php script that the PHP interpreter runs on access. The dangerous combination is trusted-client validation plus an extension-agnostic rename plus web-reachable storage.

Affected ProductsAI

alexusmai/laravel-file-manager version 3.3.1 and all prior releases are affected, deployed as a Laravel package within host applications. No CPE string was provided in the intelligence data, and the only reference is a third-party GitHub repository (https://github.com/Theethat-Thamwasin/CVE-2025-56399); no official vendor advisory URL was supplied. Applications embedding this package and exposing its upload/rename endpoints to non-administrative users are the exposed surface.

RemediationAI

No vendor-released patched version was identified in the provided data, so treat fix availability as unconfirmed: monitor the alexusmai/laravel-file-manager GitHub project and Packagist for a release above 3.3.1 and upgrade to it once published. As specific compensating controls in the interim: configure the web server (or the storage disk) so the upload directory cannot execute PHP - for Apache add 'php_admin_flag engine off' or remove the PHP handler for that path, or on nginx route the upload location without the PHP FastCGI pass; store uploads outside the public web root and serve them only through a controller that streams content with a forced non-executable content type; and restrict or disable the rename API, or enforce a server-side allowlist of permitted extensions on both upload and rename, since client-side validation is bypassable. Also limit file-manager access to trusted administrators only. Trade-offs: disabling PHP execution in the storage path is low-impact and highly effective; disabling rename removes legitimate functionality; serving through a controller adds overhead but closes direct-URL execution. Reference the tracking repository at https://github.com/Theethat-Thamwasin/CVE-2025-56399 for PoC details when validating fixes.