Open-source package vulnerability · Composer (PHP)
CVE-2025-46001: simogeo/filemanager arbitrary file upload vulnerability
criticalCVSS 3.1 9.8GHSA-m5hw-rhvr-f47c
An arbitrary file upload vulnerability in the isallowedfiletype() function of Filemanager v2.3.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
Published Jul 18, 2025 · Updated Jul 23, 2025
Affected packages
simogeo/filemanager
- Ecosystem
- Composer (PHP)
- Affected
- < 2.5.0
- Fixed in
- No patched version yet
- Check
composer show simogeo/filemanager
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
An arbitrary file upload vulnerability in the is_allowed_file_type() function of Filemanager v2.3.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology