https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-65346.htmlhttps://patchthecve.com/cve/CVE-2025-65346.htmlWed, 17 Jun 2026 09:55:38 +0000CRITICAL 9.1: alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The unzip/extraction functionality improperly allows archive contents to be written to arbitrary locations on the filesystem due to insufficient validation of extraction paths.https://patchthecve.com/cve/CVE-2025-65345.htmlhttps://patchthecve.com/cve/CVE-2025-65345.htmlWed, 17 Jun 2026 09:55:38 +0000MEDIUM 6.5: alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The zip/archiving functionality allows an attacker to create archives containing files and directories outside the intended scope due to improper path validation.https://patchthecve.com/cve/CVE-2025-63307.htmlhttps://patchthecve.com/cve/CVE-2025-63307.htmlWed, 17 Jun 2026 09:53:01 +0000HIGH 8.1: alexusmai laravel-file-manager 3.3.1 is vulnerable to Cross Site Scripting (XSS). The application permits user-controlled upload, create, and rename of files to HTML and SVG types and serves those files inline without adequate content-type validation or output sanitization.