This affects versions of the package unisharp/laravel-filemanager before 2.6.2. The upload() function does not sufficiently validate the file type whe...
Description d'origine La description telle que publiée par la source (souvent en anglais).
This affects versions of the package unisharp/laravel-filemanager before 2.6.2. The upload() function does not sufficiently validate the file type when uploading.An attacker may be able to reproduce the following steps:1. Install a package with a web Laravel application.2. Navigate to the Upload window3. Upload an image file, then capture the request4. Edit the request contents with a malicious file (webshell)5. Enter the path of file uploaded on URL - Remote Code ExecutionNote: Prevention for bad extensions can be done by using a whitelist in the config file(lfm.php). Corresponding document can be found in here.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory snyk.io
- report github.com
- report github.com
- web github.com
- web github.com
- web security.snyk.io