Vulnerability Description
UniSharp Laravel File Manager v2.0.0-alpha7 and v2.0 contain an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by sending multipart form data to the upload endpoint. Attackers can upload PHP files with the type parameter set to Files and execute arbitrary code by accessing the uploaded file through the working directory path.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/UniSharp/laravel-filemanager
- https://github.com/UniSharp/laravel-filemanager/issues/356
- https://www.exploit-db.com/exploits/46389
- https://www.vulncheck.com/advisories/unisharp-laravel-file-manager-alpha7-arbitr
FAQ
What is CVE-2019-25673?
CVE-2019-25673 is a vulnerability with a CVSS score of 8.8 (HIGH). UniSharp Laravel File Manager v2.0.0-alpha7 and v2.0 contain an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by sending multipart form data to the ...
How severe is CVE-2019-25673?
CVE-2019-25673 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-25673?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.