Threat database

A vulnerability in alexusmai laravel-file-manager versions 3.3.1 and earlier allows an authenticated attacker to achieve remote code execution by uploading a file with a '.png' extension containing PHP code. Despite client-side validation failure, the file is saved on the server. The attacker can then rename the file to have a '.php' extension using the rename API, enabling execution of the embedded PHP code via a public URL.