GHSA-5m2h-7rf2-rpx6MediumCVSS 6.5

UniSharp Laravel Filemanager directory traversal vulnerability

Published
September 15, 2022
Last Modified
December 7, 2023

🔗 CVE IDs covered (1)

CVE-2022-40734 →

📋 Description

UniSharp laravel-filemanager (aka Laravel Filemanager) with league/flysystem version < 2.0.0 allows download?working_dir=%2F.. directory traversal to read arbitrary files, as exploited in the wild in June 2022.

Since v2.6.4, UniSharp laravel-filemanager (aka Laravel Filemanager) requires users to install league/flysystem version >= 2.0.0.

🎯 Affected products1

  • composer/unisharp/laravel-filemanager:< 2.6.4

🔗 References (6)