Weave Code
Kcfinder Bundle Laravel Package
ikadoc/kcfinder-bundle
Integrates KCFinder, the open-source web file manager, into Symfony applications. Provides bundle setup and routing so you can browse, upload, and manage files from CKEditor or standalone, using a familiar PHP backend.
Symfony bundle for KCFinder (CKeditor)
Frequently asked questions about Kcfinder Bundle
- Is ikadoc/kcfinder-bundle a Laravel package?
- No. It is a Symfony bundle registered in config/bundles.php or AppKernel, and it relies on Symfony's bundle, routing, and configuration conventions. Laravel has no bundle concept; it uses service providers, container bindings, and publishable config files. The mismatch is structural rather than a simple namespace rename, and the package ships no Laravel service provider, config stub, or facade.
- Can I install ikadoc/kcfinder-bundle in a Laravel app with Composer?
- Composer may resolve the dependency, but installation does not produce a working integration. Without a service provider, publishable configuration, or Laravel-compatible routes, nothing is wired into the framework automatically. You would be forking the bundle into a service provider, which discards most of its value beyond acting as a reference layout for browse and upload endpoints.
- Which Laravel and PHP versions does kcfinder-bundle support?
- There is no declared Laravel support because the package targets Symfony. KCFinder itself is a procedural PHP 5-era codebase last active around 2014 to 2015, and PHP 8.1+ compatibility, which Laravel 10 and 11 require, is unverified and likely broken. Pin the PHP version and test explicitly, and budget for a compatibility fork if you pursue it at all.
- What license does kcfinder-bundle use and can I ship it commercially?
- The bundle is MIT-licensed, but the bundled KCFinder asset manager is GPL. Shipping a GPL component inside a proprietary Laravel product requires legal review before any code lands. Confirm with counsel whether your distribution model, including SaaS or on-premise delivery, is compatible before adopting it.
- Is KCFinder safe for production file uploads?
- KCFinder has a documented history of critical vulnerabilities, including arbitrary file upload leading to remote code execution, directory traversal, and cross-site scripting in the browser UI. Upstream is dormant with no security response or disclosure process, so no patches are expected. The upload path also bypasses Laravel validation, authorization policies, Flysystem storage, and MIME handling, creating a parallel trust boundary next to the framework.
- How do I integrate KCFinder with CKEditor in a Laravel application?
- Treat the Symfony bundle as a reference rather than a dependency. Re-baseline the requirement to policy-controlled media upload for the rich-text editor, then implement it with maintained packages such as spatie/laravel-medialibrary plus a CKEditor upload adapter, or UniSharp/laravel-filemanager if a full browser UI is genuinely needed. If KCFinder must be reused, vendor it outside the public directory, front it with Laravel auth and session middleware, and point uploads at a disk outside the web root with PHP execution disabled.
- What are the best alternatives to kcfinder-bundle for Laravel?
- For most Laravel applications, spatie/laravel-medialibrary covers associative media handling, conversions, and storage abstraction. If editors need a browsing UI, UniSharp/laravel-filemanager is the closest maintained equivalent. Both integrate with Laravel's authorization, validation, and filesystem disks, which KCFinder does not. The replacement path is generally cheaper than maintaining a fork of a dormant Symfony bundle.
- How does kcfinder-bundle handle upload paths and access rules?
- It exposes KCFinder's upload and browsing settings through Symfony configuration rather than KCFinder's own conf/config.php. That configuration approach is a reasonable template: a browse endpoint, an upload endpoint, and per-type settings sourced from environment variables. In Laravel you would replicate that shape with a config file, a disk definition, and route middleware instead of the bundle itself.
- Does kcfinder-bundle have tests, CI, or active maintenance?
- There is no evident test coverage or CI, and the repository has around six stars, zero dependents, and a single maintainer. Upstream KCFinder is likewise dormant, so there is no upgrade path and the code ages without fixes. Adopting it means inheriting the fork and its maintenance budget indefinitely.
- How do I migrate away from KCFinder to a Laravel-native media solution?
- Sequence the work as security review, isolated proof of concept, threat model, build-versus-replace decision, then exposure to editors. Inventory existing uploads and rewrite paths onto a Laravel disk, replace KCFinder's session and auth with Laravel middleware, and route validation through Form Requests and authorization policies. Keep the bundle's endpoint layout as a design reference, but do not place the legacy component on any customer-facing path during or after the transition.
Weaver
How can I help you explore Laravel packages today?