GHSA-5m2h-7rf2-rpx6
UniSharp Laravel Filemanager directory traversal vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | unisharp/laravel-filemanager | < 2.6.4 | 2.6.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
UniSharp laravel-filemanager (aka Laravel Filemanager) with `league/flysystem` version `< 2.0.0` allows download?working_dir=%2F.. directory traversal to read arbitrary files, as exploited in the wild in June 2022.
Since `v2.6.4`, UniSharp laravel-filemanager (aka Laravel Filemanager) requires users to install `league/flysystem` version `>= 2.0.0`.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2022-40734
- https://github.com/UniSharp/laravel-filemanager/issues/1150
- https://github.com/UniSharp/laravel-filemanager/issues/1150#issuecomment-1320186966
- https://github.com/UniSharp/laravel-filemanager/issues/1150#issuecomment-1825310417
- https://github.com/UniSharp/laravel-filemanager/commit/8a357d02e8f54ddf130961c64ff2cfc1882bbfcf
- https://github.com/UniSharp/laravel-filemanager