CVE-2025-65345: 
PHP vulnerability analysis and mitigation

CVE-2025-65345 is an authenticated directory traversal vulnerability in the alexusmai/laravel-file-manager Laravel package (versions 3.3.1 and below). The flaw resides in the zip/archiving functionality, which fails to properly validate file paths, allowing authenticated attackers to create archives containing files and directories outside the intended storage scope. It was published on December 3, 2025, with a CVSS v3.1 base score of 6.5 (Medium) assigned by CISA-ADP, and a CVSS v4.0 score of 2.9 (Low) per the GitHub Advisory Database (Github Advisory, Red Hat CVE).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and stems from insufficient path validation in the zip/archiving feature of laravel-file-manager (Github Advisory). An authenticated attacker can manipulate the ZIP request payload to include directory traversal sequences (e.g., ../../../../../var/www or references to /etc/passwd) before triggering archive creation; the backend recursively resolves these paths outside the allowed storage directory. The attacker then downloads the generated ZIP archive, which contains sensitive files from arbitrary server locations. A public PoC repository documenting the attack steps has been published at https://github.com/tlekrean/CVE-2025-65345 (PoC Repo).

Successful exploitation enables arbitrary file disclosure, allowing an attacker to retrieve sensitive server-side files such as .env configuration files (containing database credentials and application secrets), SSH keys, log files, and other application configuration data (PoC Repo). Disclosure of credentials found in these files can facilitate privilege escalation, lateral movement to backend databases, or enable further attack chains including potential remote code execution. Availability is not directly impacted, but confidentiality and integrity of the file management system's security boundaries are compromised (Github Advisory).

A public PoC repository (GHSA-rr44-8j7r-jg2q) documenting exploitation steps was published on December 3, 2025, shortly after CVE disclosure (PoC Repo). Exploitation requires authentication — the attacker must have access to the file manager interface — which somewhat limits the attack surface. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time, and the EPSS score is approximately 0.097% (low probability of exploitation within 30 days) (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Authenticate: Obtain valid credentials for a Laravel application using the alexusmai/laravel-file-manager package (v3.3.1 or below) and log in to the file manager interface.
2. Navigate to the zip/archive function: Within the file manager GUI, select a file or folder to trigger the ZIP creation workflow.
3. Intercept and manipulate the request: Using a proxy tool (e.g., Burp Suite), intercept the ZIP creation HTTP request and modify the file path parameter to include directory traversal sequences such as ../../../../../etc/passwd or ../../../../../var/www/html/.env.
4. Trigger archive creation: Submit the manipulated request; the backend resolves the traversal path without proper validation and recursively includes files from outside the intended storage directory in the generated archive.
5. Download and extract the archive: Download the resulting ZIP file through the file manager interface and extract it locally to access the sensitive files (e.g., .env, SSH keys, configuration files) from arbitrary server locations (PoC Repo).

• Network: Unusual HTTP POST/GET requests to the file manager's zip/archive endpoint containing path traversal sequences (../, %2e%2e%2f, %2e%2e/) in file path parameters; subsequent download requests for generated ZIP archives shortly after traversal-containing archive requests.
• File System: Unexpected ZIP archive files in the application's storage or temporary directory containing files from outside the designated storage root (e.g., /etc/passwd, .env, SSH key files); archives with unusual directory structures referencing system paths.
• Logs: Laravel application logs (storage/logs/laravel.log) showing file path resolution errors or warnings related to paths outside the storage directory; web server access logs recording archive creation and download requests with encoded traversal sequences in parameters.
• Process: Unexpected file read operations by the web server process (e.g., www-data, apache, nginx) on sensitive system files such as /etc/passwd, /etc/shadow, or application .env files.

As of the GitHub Advisory publication date (December 3, 2025), no patched version of alexusmai/laravel-file-manager had been released — the advisory lists "None" for patched versions (Github Advisory). Feedly's executive summary recommends upgrading to a version higher than 3.3.1 if/when available. In the interim, administrators should implement strict server-side path validation to normalize and restrict file paths to the designated storage root, reject any path containing traversal sequences (../, %2e%2e/), apply allowlist logic for ZIP creation to only permit explicitly allowed directories, restrict file system permissions for the web server process using the principle of least privilege, and monitor file manager activity for anomalous archive creation requests (PoC Repo).

The vulnerability was discovered and reported by Chindanai Klabtung, Chayawat Jeamprasertboon, Thanakorn Boontem, and Theethat Thamwasin, who published a detailed PoC repository on GitHub (PoC Repo). Red Hat tracked the CVE in their security advisory database, and CISA-ADP contributed the CVSS v3.1 scoring (Red Hat CVE). No significant broader media coverage or notable community debate has been identified beyond standard vulnerability database aggregation.