The alexusmai laravel-file-manager version 3.3.1 contains a Cross Site Scripting (XSS) vulnerability. This flaw arises because the application allows users to upload, create, and rename files with HTML and SVG content types and serves these files inline without proper content-type validation or output sanitization.