CVE-2019-25673 UniSharp CVE debrief

Who should care

Security teams and administrators responsible for UniSharp Laravel File Manager installations should be aware of this vulnerability and take necessary actions to mitigate it. They should review the vulnerability details, assess their exposure, and implement necessary security measures.

Technical summary

The vulnerability exists in the upload endpoint of UniSharp Laravel File Manager, allowing attackers to upload PHP files with the type parameter set to Files. This can lead to arbitrary code execution by accessing the uploaded file through the working directory path. The vulnerability affects UniSharp Laravel File Manager versions 2.0.0-alpha7 and 2.0. Security teams should review the vulnerability details, assess their exposure, and implement necessary security measures to mitigate the vulnerability. Affected product deployments should be identified and assigned an owner for follow-up. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified.

Defensive priority

High

Recommended defensive actions

• Update UniSharp Laravel File Manager to a version that fixes the arbitrary file upload vulnerability
• Restrict access to the upload endpoint to only trusted users
• Implement additional security measures, such as file type validation and monitoring for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-04-05T21:16:45.113Z and last modified on 2026-07-24T22:10:00.140Z. The NVD entry is currently Deferred. The vulnerability affects UniSharp Laravel File Manager versions 2.0.0-alpha7 and 2.0. Evidence is limited to public CVE and NVD information.

Official resources