What is GHSA-q5hg-wppq-r2cc?

GHSA-q5hg-wppq-r2cc is a security advisory published by GitHub Security Advisories with High severity. alexusmai laravel-file-manager is vulnerable to Directory Traversal via the unzip/extraction functionality

Which CVE IDs does GHSA-q5hg-wppq-r2cc cover?

GHSA-q5hg-wppq-r2cc covers the following CVE IDs: CVE-2025-65346. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-q5hg-wppq-r2cc?

GHSA-q5hg-wppq-r2cc has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

Which products are affected by GHSA-q5hg-wppq-r2cc?

GHSA-q5hg-wppq-r2cc affects 1 product, including: composer/alexusmai/laravel-file-manager:\u003c= 3.3.1.

GHSA-q5hg-wppq-r2ccHighCVSS 9.1

alexusmai laravel-file-manager is vulnerable to Directory Traversal via the unzip/extraction functionality

Vendor

GitHub Security Advisories

Published

December 4, 2025

Last Modified

December 5, 2025

🔗 CVE IDs covered (1)

CVE-2025-65346 →

📋 Description

alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The unzip/extraction functionality improperly allows archive contents to be written to arbitrary locations on the filesystem due to insufficient validation of extraction paths.

🎯 Affected products1

composer/alexusmai/laravel-file-manager:<= 3.3.1

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-65346
https://github.com/Theethat-Thamwasin/CVE-2025-65346
https://github.com/alexusmai/laravel-file-manager
https://github.com/Theethat-Thamwasin/CVE-2025-65346/blob/main/POC-CVE-65346.md
https://github.com/advisories/GHSA-q5hg-wppq-r2cc