This affects the package unisharp/laravel-filemanager prior to version 2.6.2. The upload() function does not sufficiently validate the file type when uploading.

An attacker may be able to reproduce the following steps:

• Install a package with a web Laravel application.
• Navigate to the Upload window
• Upload an image file, then capture the request
• Edit the request contents with a malicious file (webshell)
• Enter the path of file uploaded on URL
• Remote Code Execution

**Note: Prevention for bad extensions can be done by using a whitelist in the config file(lfm.php). Corresponding document can be found in the here.

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-23814
• https://snyk.io/vuln/SNYK-PHP-UNISHARPLARAVELFILEMANAGER-1567199
• UniSharp/laravel-filemanager#1113 (comment)
• UniSharp/laravel-filemanager@bd84899
• https://github.com/UniSharp/laravel-filemanager/blob/master/src/Controllers/UploadController.php#L26
• https://github.com/UniSharp/laravel-filemanager/blob/master/src/Controllers/UploadController.php%23L26