A high-severity Cross Site Scripting vulnerability in alexusmai laravel-file-manager 3.3.1 allows authenticated attackers to execute arbitrary scripts in the context of the application.

The vulnerability stems from the application permitting the upload, creation, and renaming of files to HTML and SVG types, which are subsequently served inline without sufficient output sanitization or content-type validation. This flaw requires high privileges to trigger, as the attacker must be capable of file management operations.

Successful exploitation allows an attacker to execute malicious scripts within the browser session of other users, including administrators. This could lead to session hijacking, unauthorized actions performed on behalf of the victim, or the theft of sensitive session data. Given the CVSS score of 8.1, this represents a significant risk to data integrity and user account security within the affected environment.

Immediate Action: Restrict file upload capabilities for untrusted or unauthorized users immediately and monitor the vendor repository for an official security patch.

Proactive Monitoring: Review web access logs for suspicious file upload activity, specifically looking for attempts to upload or rename files with .html or .svg extensions.

Compensating Controls: Implement a Content Security Policy (CSP) that restricts the execution of inline scripts and prevents the loading of untrusted resources, which can help mitigate the impact of XSS attacks.

Public Exploit Available: Yes, a public proof-of-concept exists via the GitHub repository referenced in the CVE record.

Organizations utilizing laravel-file-manager version 3.3.1 should treat this vulnerability with high urgency. Given the availability of a public proof-of-concept, administrators should prioritize restricting file management permissions to known, trusted users and implement strict file type validation as an immediate defensive measure until a vendor-supplied patch is applied.