CVE-2021-43617: Malicious File Upload
Image upload bypass
Other sources
Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-43617?
CVE-2021-43617 is a vulnerability that allows bypassing image upload restrictions in Laravel framework versions 8.0.0 up to 8.71.0.
How does the image upload bypass vulnerability work?
The image upload bypass vulnerability in Laravel framework allows an attacker to upload malicious images by exploiting a security flaw in the upload validation process.
What is the impact of CVE-2021-43617?
The impact of CVE-2021-43617 is that it allows attackers to bypass restrictions and upload potentially malicious files, which can lead to further exploitation of the system.
How can I fix the image upload bypass vulnerability (CVE-2021-43617)?
To fix the image upload bypass vulnerability, you should upgrade your Laravel framework to a version higher than 8.71.0, or apply the patch provided by Laravel.
Where can I find more information about the image upload bypass vulnerability in Laravel framework?
More information about the image upload bypass vulnerability can be found in the GitHub pull request: https://github.com/laravel/framework/pull/39666