Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
unisharp/laravel-filemanager
master @ 4fa7ec1
14
Fixes
1
CVEs
HIGH
Peak severity
23.1%
Coverage
Highlights
Arbitrary File Upload: 5 prior fixes. Scrutinize any change in this area.
src/LfmUploadValidator.php: most-fixed (6 issues). Treat as high-risk during review.
12 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Arbitrary File Upload: Attackers can bypass upload restrictions and achieve remote code execution (RCE) by uploading executable scripts (e.g., PHP, HTML) using non-normalized extension casing, special characters, or sub-extensions starting with 'php'.
Path Traversal: Without validating that a requested path physically resides within the designated storage disk boundaries prior to executing filesystem operations (like unlink or download), malicious actors can read or delete sensitive files across the server.
Stored XSS: Insecure default configurations (such as allowing SVG uploads or disabling strict MIME-type validation) allow malicious scripts to be stored on the server and executed within a user's browser context.