CVE-2022-40734: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

September 14, 2022 (updated November 24, 2023)

UniSharp laravel-filemanager (aka Laravel Filemanager) through 2.5.1 allows download?working_dir=%2F.. directory traversal to read arbitrary files, as exploited in the wild in June 2022.

References

github.com/UniSharp/laravel-filemanager/issues/1150
nvd.nist.gov/vuln/detail/CVE-2022-40734

Detect and mitigate CVE-2022-40734 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →