A Scanner Hit Our Edge 120,000 Times in Three Days Looking for elFinder, KCFinder and Laravel File Managers. Check Whether Yours Answers.
If you run a PHP or Laravel site, check today whether any of these answer from the internet: an elFinder connector, KCFinder's upload.php, CKFinder's PHP connector, laravel-filemanager's upload route, or the Responsive File Manager plugin for TinyMCE. Each one accepts a file upload, and an upload endpoint with no login in front of it is a webshell waiting to happen. One scanner sent about 120,000 requests to our edge from November 12 to 14, and nine out of ten were for those eleven paths. Delete what you don't use, put a login in front of what you keep, and check the same toolkit's other targets: PHPUnit, Laravel Ignition, Livewire and Vite, all four on CISA's exploited list.
What we saw
Our edge blocks and decoy traps recorded 129,738 blocked requests between November 12 and 14:35 UTC November 14. 120,193 of them, about 93%, came from one toolkit on four hosts:
167.172.40.179, DigitalOcean, Netherlands: 82,365 requests.
2a02:c207:2300:1914::1, Contabo, France: 23,118, still running at 14:35 UTC today.
2a03:b0c0:2:f0:0:2:4050:f001, DigitalOcean, Netherlands: 14,678.
207.180.205.120, Contabo, France: 29.
We call it one toolkit, not four actors, because all four send the same three browser identities (Chrome 132 on Linux, Chrome 133 on macOS, Chrome 134 on Windows) in nearly equal thirds and work the same list. The DigitalOcean IPv4 host first hit one of our traps on November 10.
What it looks for
The file-manager paths took 111,029 requests, about 9,250 each, over and over:
/elfinder/php/connector.minimal.php (about 18,500, twice the others), /elfinder/php/connector.php, /elfinder/connector.php, /assets/elfinder/php/connector.minimal.php, /filemanager/elfinder/php/connector.minimal.php
/vendor/barryvdh/elfinder/php/connector.php, the elFinder bridge for Laravel
/ckfinder/core/connector/php/connector.php
/kcfinder/upload.php
/filemanager/upload.php
/laravel-filemanager/upload
/tinymce/plugins/responsivefilemanager/filemanager/upload.php
The rest of the list is a Laravel stack check, and four of its targets are in CISA's Known Exploited Vulnerabilities catalog:
PHPUnit eval-stdin.php, 3,430 requests across ten paths: CVE-2017-9841, added to KEV February 15, 2022. A vendor folder left reachable on the web runs whatever code is posted to it.
Laravel Ignition, 336 requests to /_ignition/execute-solution: CVE-2021-3129, added to KEV September 18, 2023.
Livewire, 414 requests for livewire.js and livewire.min.js: these files reveal the version. CVE-2025-54068 was added to KEV March 20, 2026.
Vite, 276 requests for /@vite/client and /@vite/env: these find a Vite development server exposed to the internet. CVE-2025-31125 was added to KEV January 22, 2026.
Secrets, 2,533 requests for .env and ten backup spellings of it, plus /.aws/credentials.
It also asked for 339 files named .laratrace-probe- followed by twelve random hex characters, each name used once. We think it does this to see what a site returns for a file that cannot exist, so it can tell a real hit from a site that answers 200 to everything. That reading is our inference, not something the tool told us.
What is not known
Who runs it. There is no attribution, and the hosting is rented.
Whether it is new. We found no new elFinder, KCFinder or CKFinder CVE in CISA's catalog or our own index. It looks like an old list run hard, not a reaction to fresh research.
What it does on a hit. Every request was blocked or answered by a decoy, so we never saw what it uploads.
What to do
Request each path on your own sites from outside your network. Anything other than a 404 or a login page needs a look.
Delete file managers you don't use. They are often installed with an admin template or an old editor plugin and forgotten.
Put the ones you keep behind authentication, at the web server or the app's middleware, not just a hidden URL. For laravel-filemanager and the barryvdh elFinder bridge, check the route middleware in the package config.
Block the vendor folder from the web. Nothing under /vendor should be served. That alone kills the PHPUnit path.
Laravel: set APP_DEBUG to false in production, update Ignition and Livewire, and never expose a Vite dev server.
Make sure .env is not reachable, including the backup and swap copies the scanner asks for.
Block the four hosts above. All four are in our published IP feed at confidence 95, as our own first-party observations.
Hunt for what may already be there. Look in upload folders for .php, .phtml or .phar files, and in access logs for POST requests to the paths above.
How we know
These counts come from our own instruments: edge-shield blocks and the decoy traps inside the edge worker, read with our cross-instrument check on November 14 for the window from November 12 at 00:00 UTC. Requests that matched our own blog URLs were left out of the path list. We confirmed all four hosts in our iocs index and in the published ips.csv download (7,616 rows, byte count matching the server's content-length). KEV dates are from CISA's JSON feed, read the same day.
Sources
CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
DugganUSA IP feed (free API key): https://analytics.dugganusa.com/stix/register
How do AI models see YOUR brand?
AIPM has audited 250+ domains. 15 seconds. Free while still in beta.
Comments