A critical directory traversal vulnerability in alexusmai laravel-file-manager allows unauthenticated attackers to perform arbitrary file writes, potentially leading to remote code execution.

This is a directory traversal vulnerability occurring within the unzip/extraction functionality. It allows an unauthenticated attacker to escape intended directories and write malicious files to the filesystem.

With a CVSS score of 9.1, this vulnerability poses a severe threat to system integrity. By writing arbitrary files, an attacker could upload web shells or overwrite critical configuration files, leading to full application takeover and unauthorized access to sensitive data.

Immediate Action: As no fix is currently available, restrict access to the file manager functionality or disable the component entirely until a patch is released by the maintainer.

Proactive Monitoring: Review filesystem integrity logs for unexpected file creation or modifications in sensitive application directories.

Compensating Controls: Implement strict input validation at the WAF level to block archive files containing path traversal sequences (e.g., ../).

Public Exploit Available: Yes — a public proof-of-concept repository exists on GitHub.

Due to the lack of an official patch and the presence of public proof-of-concept code, this vulnerability presents an immediate risk. Organizations are strongly advised to disable the affected component until the vendor provides a secure update.