CVE-2024-52306

9.8 criticalEPSS 0.6%

Critical (9.8) in backpackforlaravel filemanager. EPSS 0.6% chance of exploitation in the next 30 days.

FileManager provides a Backpack admin interface for files and folder. Prior to 3.0.9, deserialization of untrusted data from the mimes parameter could lead to remote code execution. This vulnerability is fixed in 3.0.9.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-31)
CWE: CWE-502
Published: 2024-11-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

backpackforlaravel:filemanager

References

https://github.com/Laravel-Backpack/FileManager/commit/2830498b85e05fb3c92179053b4d7c4a0fdb880b
https://github.com/Laravel-Backpack/FileManager/security/advisories/GHSA-8237-957h-h2c2

Check your stack JSON