CVE-2025-65346: 
PHP vulnerability analysis and mitigation

CVE-2025-65346 is a path traversal (Zip Slip) vulnerability in the alexusmai/laravel-file-manager Laravel package, affecting versions 3.3.1 and below. The flaw exists in the unzip/extraction functionality, which fails to validate extraction paths, allowing archive contents to be written to arbitrary filesystem locations. It was published on December 4, 2025, with a PoC added to GitHub on December 16, 2025. The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical) (Github Advisory, Feedly).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), where the extraction routine resolves ZIP entry paths without sanitizing traversal sequences such as ../../ or absolute paths (Github Advisory). An attacker crafts a malicious ZIP archive with entries containing path traversal sequences (e.g., ../../routes/web.php) and submits it to the application's unzip endpoint; the backend writes the file directly to the resolved location with the permissions of the running web process (PoC Repo). While the CVSS vector lists no privileges required, the PoC notes that authentication may or may not be required depending on the application's configuration of the file manager — default deployments may restrict access to authenticated users (PoC Repo). A public PoC walkthrough is available at the researcher's GitHub repository (PoC File).

Successful exploitation allows an attacker to write arbitrary files to any location writable by the web server process (e.g., www-data), enabling overwriting of critical application files such as routes, controllers, configuration files, or index.php (PoC Repo). By writing PHP web shells or executable payloads into the webroot, an attacker can achieve full remote code execution on the server. Overwriting .env or configuration files may also expose secrets such as database credentials or API keys, enabling lateral movement to connected systems (PoC File).

A public proof-of-concept exploit is available on GitHub, published by researcher Theethat Thamwasin on December 16, 2025 (PoC File). There is no confirmed evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported (Feedly). The EPSS score is approximately 0.43%, indicating a currently low but non-negligible probability of exploitation in the near term (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the time of this report.

1. Reconnaissance: Identify Laravel applications using the alexusmai/laravel-file-manager package (version ≤ 3.3.1) by inspecting composer.json disclosures, error pages, or web fingerprinting tools.
2. Obtain access: If the file manager requires authentication, obtain valid credentials (e.g., via phishing, credential stuffing, or a free/trial account if self-registration is enabled).
3. Craft malicious ZIP: Create a ZIP archive containing a PHP web shell or payload file with a path traversal entry name, such as ../../public/shell.php or ../../routes/web.php, using tools like Python's zipfile module or a hex editor.
4. Upload the archive: Use the file manager's upload functionality to upload the crafted ZIP archive to the server's storage directory.
5. Trigger extraction: Invoke the unzip/extract function via the file manager interface while intercepting the HTTP request (e.g., using Burp Suite) to confirm the traversal path is included in the request payload.
6. Verify file write: Confirm the payload was written to the target directory by browsing to the expected URL (e.g., https://target.com/shell.php) or checking for modified application behavior.
7. Achieve RCE: Access the dropped web shell or modified route to execute arbitrary commands on the server with the privileges of the web server process (PoC File, PoC Repo).

• Network: Unusual POST requests to the file manager's unzip/extract endpoint (e.g., /file-manager/unzip or similar) containing path traversal sequences (../, %2e%2e%2f) in request parameters; outbound connections from the web server to unknown external IPs following extraction events.
• File System: Unexpected PHP files (e.g., shell.php, modified web.php, index.php) appearing outside the designated storage/upload directory, particularly in public/, routes/, config/, or bootstrap/; modification timestamps on core application files inconsistent with deployment history.
• Logs: Web server access logs showing POST requests to the unzip endpoint followed shortly by GET requests to newly created files in the webroot; Laravel application logs recording file write operations to paths outside the configured storage root.
• Process: Unusual child processes spawned by the PHP-FPM or Apache/Nginx worker process (e.g., bash, curl, wget, python) after a file extraction event (PoC Repo, PoC File).

The Feedly executive summary indicates a patch is available in version 3.3.2; affected organizations should upgrade from version 3.3.1 or lower immediately (Feedly). Note that the GitHub Advisory Database lists no patched version as of its last update (December 5, 2025), so administrators should verify the latest release on the project repository before upgrading. As interim mitigations: restrict access to the file manager to trusted, authenticated users only; implement server-side canonical path validation that enforces extraction within the designated storage root; and consider temporarily disabling the unzip/extraction feature until patching is confirmed (PoC Repo). Additionally, monitor for unauthorized file changes in the webroot and application directories.

The vulnerability was discovered and reported by researcher Theethat Thamwasin, who published a detailed PoC walkthrough on GitHub (PoC Repo). The GitHub Advisory Database reviewed and published the advisory on December 5, 2025, and Red Hat tracked it in their security CVE database (Github Advisory, Red Hat). No significant broader media coverage or notable community debate has been identified beyond standard vulnerability tracking platforms.