VYPR
← All advisories
High severity8.1NVD Advisory· Published Nov 6, 2025· Updated Jun 17, 2026

CVE-2025-63307

CVE-2025-63307

Description

alexusmai laravel-file-manager 3.3.1 is vulnerable to Cross Site Scripting (XSS). The application permits user-controlled upload, create, and rename of files to HTML and SVG types and serves those files inline without adequate content-type validation or output sanitization.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Alexusmai/Laravel File Manager3 versions
    cpe:2.3:a:alexusmai:laravel_file_manager:3.3.1:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:alexusmai:laravel_file_manager:3.3.1:*:*:*:*:*:*:*
    • (no CPE)
    • (no CPE)range: <=3.3.1

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.