File Upload Vulnerability in Laravel Nova Package by Marshmallow Packages

CVE-2025-54082

What is CVE-2025-54082?

The marshmallow-packages/nova-tiptap vulnerability allows unauthenticated users to upload arbitrary files to any Laravel disk configured within the application. This issue arises from the absence of authentication middleware on the file upload endpoint, inadequate validation of uploaded files, and the dynamic selection of disk parameters by an attacker. Consequently, malicious files can be uploaded, potentially leading to remote code execution if these files are executed. This vulnerability affects versions prior to 5.7.0 and was rectified in the subsequent release.

References