CVE-2024-52306

FileManager Deserialization of Untrusted Data

CVSS 7.7 HIGHEPSS 0.6%CWE-502

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.7EPSS 0.6%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

13 Nov 2024Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

FileManager provides a Backpack admin interface for files and folder. Prior to 3.0.9, deserialization of untrusted data from the mimes parameter could lead to remote code execution. This vulnerability is fixed in 3.0.9.

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Affected products

Laravel-Backpack · FileManager

References

https://github.com/Laravel-Backpack/FileManager/commit/2830498b85e05fb3c92179053b4d7c4a0fdb880b https://github.com/Laravel-Backpack/FileManager/security/advisories/GHSA-8237-957h-h2c2