CVE-2021-23814

This affects versions of the package unisharp/laravel-filemanager before 2.6.2. The upload() function does not sufficiently validate the file type when uploading. An attacker may be able to reproduce the following steps: 1. Install a package with a web Laravel application. 2. Navigate to the Upload window 3. Upload an image file, then capture the request 4. Edit the request contents with a malicious file (webshell) 5. Enter the path of file uploaded on URL - Remote Code Execution **Note:** Prevention for bad extensions can be done by using a whitelist in the config file(lfm.php). Corresponding document can be found in [here](https://unisharp.github.io/laravel-filemanager/configfolder-categories).

• CWE-94
• CWE-434

• https://github.com/UniSharp/laravel-filemanager/blob/master/src/Controllers/UploadController.php%23L26Broken Link, Third Party Advisory
• https://github.com/UniSharp/laravel-filemanager/issues/1113
• https://github.com/UniSharp/laravel-filemanager/releases/tag/v2.5.1
• https://github.com/UniSharp/laravel-filemanager/releases/tag/v2.6.2
• https://security.snyk.io/vuln/SNYK-PHP-UNISHARPLARAVELFILEMANAGER-1567199
• https://github.com/UniSharp/laravel-filemanager/blob/master/src/Controllers/UploadController.php%23L26Broken Link, Third Party Advisory
• https://github.com/UniSharp/laravel-filemanager/issues/1113#issuecomment-1812092975
• https://snyk.io/vuln/SNYK-PHP-UNISHARPLARAVELFILEMANAGER-1567199Third Party Advisory

Published

Dec 17, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-23792The package com.twelvemonkeys.imageio:imageio-metadata befor…9.8
• CVE-2021-23797All versions of package http-server-node are vulnerable to D…9.8
• CVE-2021-2380Vulnerability in the Oracle Applications Framework product o…7.6
• CVE-2021-23803This affects the package latte/latte before 2.10.6. There is…9.8
• CVE-2021-23807This affects the package jsonpointer before 5.0.0. A type co…9.8
• CVE-2021-2381Vulnerability in the Oracle Solaris product of Oracle System…3.9
• CVE-2021-2382Vulnerability in the Oracle WebLogic Server product of Oracl…9.8
• CVE-2021-23820This affects all versions of package json-pointer. A type co…9.8
• CVE-2021-23824This affects the package Crow before 0.3+4. When using attri…6.1
• CVE-2021-23827Keybase Desktop Client before 5.6.0 on Windows and macOS, an…5.5
• CVE-2021-2383Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2021-23835An issue was discovered in flatCore before 2.0.0 build 139. …4.9