medium6.5
CVE-2022-40734
UniSharp Laravel Filemanager directory traversal vulnerability
Impact
UniSharp laravel-filemanager (aka Laravel Filemanager) with `league/flysystem` version `< 2.0.0` allows download?working_dir=%2F.. directory traversal to read arbitrary files, as exploited in the wild in June 2022. Since `v2.6.4`, UniSharp laravel-filemanager (aka Laravel Filemanager) requires users to install `league/flysystem` version `>= 2.0.0`.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | unisharp/laravel-filemanager | < 2.6.4 | 2.6.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Unisharp | Laravel Filemanager | through 2.5.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/UniSharp/laravel-filemanager/issues/1150
- https://github.com/UniSharp/laravel-filemanager/issues/1150#issuecomment-1320186966
- https://github.com/UniSharp/laravel-filemanager/issues/1150#issuecomment-1825310417
- https://github.com/advisories/GHSA-5m2h-7rf2-rpx6
- https://nvd.nist.gov/vuln/detail/CVE-2022-40734
- https://github.com/UniSharp/laravel-filemanager/commit/8a357d02e8f54ddf130961c64ff2cfc1882bbfcf