CVE-2025-63307: Alexusmai Laravel File Manager

High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days.

alexusmai laravel-file-manager 3.3.1 is vulnerable to Cross Site Scripting (XSS). The application permits user-controlled upload, create, and rename of files to HTML and SVG types and serves those files inline without adequate content-type validation or output sanitization.

Affected products

• Alexusmai Laravel File Manager: version 3.3.1 only

Published 2025-11-06. Last modified 2026-06-17.