Laravel admin package Voyager vulnerable to one-click RCE flaw

Three vulnerabilities in the popular Voyager Laravel admin package—an upload MIME-type bypass allowing polyglot file uploads (CVE-2024-55417), a popup JavaScript injection in /admin/compass enabling one-click attacks from an authenticated admin (CVE-2024-55416), and a file management path-manipulation flaw allowing arbitrary file access/deletion (CVE-2024-55415)—were disclosed by SonarSource; maintainers did not respond within the 90-day disclosure period and the issues remain unpatched, so users should restrict access, tighten file-upload/execute controls, and avoid using Voyager in sensitive production environments until fixed.