The open-source PHP package Voyager, widely used for managing Laravel applications, has been found to contain three (3) critical security vulnerabilities that could be exploited to achieve one-click remote code execution (RCE) on affected instances. The three (3) flaws are CVE-2024-55417 (arbitrary file write), CVE-2024-55416 (reflected XSS), and CVE-2024-55415 (file leak/deletion). Attackers can leverage Voyager’s media upload features to bypass MIME-type verification and upload malicious polyglot files that appear as images or videos but contain executable PHP code. Additionally, the reflected XSS flaw allows attackers to inject JavaScript into administrative popups, enabling them to execute arbitrary actions if an authenticated user clicks on a malicious link. The file management vulnerability further exposes servers to unauthorized file deletion or extraction of sensitive information. Despite responsible disclosure attempts by SonarSource researchers since September 2024, Voyager maintainers have not responded, leaving the flaws unpatched. Given the package’s widespread use among Laravel developers, including startups, freelance developers, and small to medium-sized businesses, users are advised to restrict access, limit file upload permissions, enforce strict MIME-type validation, disable PHP execution for uploaded files, and monitor logs for unusual activity. Until official patches are released, CTIX analysts recommend avoiding Voyager in production environments or migrating to alternative Laravel admin panels.