CVE-2025-56399 affects alexusmai laravel-file-manager versions before 3.3.2. The vulnerability arises because the file manager interface permits an authenticated user to upload a file with a '.png' extension that contains PHP code. Although client-side validation blocks the upload, the file is still saved on the server. The attacker can then exploit the rename API to change the file extension to '.php'. Accessing this renamed file via a public URL causes the server to execute the embedded PHP code, resulting in remote code execution. The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated attacker to execute arbitrary PHP code on the server, leading to full compromise of the affected system's confidentiality, integrity, and availability.

A fix is available in version 3.3.2 of alexusmai laravel-file-manager. Users should upgrade to version 3.3.2 or later to remediate this vulnerability. Until patched, restrict authenticated user permissions to trusted users only and monitor for suspicious file uploads and renaming activities.