9.8
Critical
CVE-2024-21546 Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE)…
Description
Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimetype and inserting the . character after the php file extension. This allows the attacker to execute malicious code.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| unisharp/laravel-filemanager 2.9 | earliest → < 2.9.1 | 2.9.1 |