critical9.8
CVE-2025-46001
simogeo/filemanager arbitrary file upload vulnerability
Impact
An arbitrary file upload vulnerability in the is_allowed_file_type() function of Filemanager v2.3.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | simogeo/filemanager | < 2.5.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Simogeo | Filemanager | from 0.8 through 1.1 from 1.5.0 through 2.0.0 |