CVE-2019-25673
UniSharp Laravel File Manager v2.0.0-alpha7 Arbitrary File Upload
- State
- Published
- Severity
- 8.7 High
- Published
- Apr 5, 2026
- Updated
- Jul 28, 2026
- Reserved
- Apr 5, 2026
Description
UniSharp Laravel File Manager v2.0.0-alpha7 and v2.0 contain an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by sending multipart form data to the upload endpoint. Attackers can upload PHP files with the type parameter set to Files and execute arbitrary code by accessing the uploaded file through the working directory path.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-434 Unrestricted Upload of File with Dangerous Type
Affected Products
| Product | Versions |
|---|---|
Laravel File ManagerUniSharp |
|
References
- ExploitDB-46389exploit
- Official Product Homepageproduct
- Source Code Repositoryissue-tracking
- VulnCheck Advisory: UniSharp Laravel File Manager v2.0.0-alpha7 Arbitrary File Uploadthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.