p PatchFirst

CVE-2024-52306

CVE-2024-52306 · FileManager Deserialization of Untrusted Data

This page contains facts from public vulnerability sources. Check the original advisory before updating.

FileManager provides a Backpack admin interface for files and folder. Prior to 3.0.9, deserialization of untrusted data from the mimes parameter could lead to remote code execution. This vulnerability is fixed in 3.0.9.

CVSS 7.7 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • filemanager

    Versions
    • < 3.0.9: Affected

    No fix published

  • backpack/filemanager Packagist

    Versions
    • 3.0.0
    • 3.0.1
    • 3.0.2
    • 3.0.3
    • 3.0.4
    • 3.0.5
    • 3.0.6
    • 3.0.7
    • 3.0.8
    Affected ranges
    • ECOSYSTEM: ≥ 3.0.0, < 3.0.9

    Update to 3.0.9

  • backpack/filemanager Packagist

    Versions
    • 1.0.0
    • 1.1.0
    • 1.1.1
    • 1.1.2
    • 1.1.3
    • 1.1.4
    • 1.1.5
    • 1.1.6
    • 1.1.7
    • 2.0.0
    • 2.0.1
    Affected ranges
    • ECOSYSTEM: < 2.0.2

    Update to 2.0.2

Original sources

Check your server →