CVE-2024-13918: Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page
First published: Mon Mar 10 2025(Updated: )
The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page.
Credit: 1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4a
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Laravel Framework | >=11.9.0<=11.35.1 | |
| composer/laravel/framework | >=11.9.0<11.36.0 | 11.36.0 |
| Laravel | >=11.9.0<11.36.0 |
Remedy
Update to version 11.36.0 or later.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20241209-01_Laravel_Reflected_XSS_via_Request_Parameter_in_Debug-Mode_Error_Page
- https://github.com/laravel/framework/pull/53869
- https://github.com/laravel/framework/releases/tag/v11.36.0
- http://www.openwall.com/lists/oss-security/2025/03/10/3
- https://nvd.nist.gov/vuln/detail/CVE-2024-13918
- https://github.com/laravel/framework/commit/45287fb2a91c69bb1c110539b9b7341faf5aee33
- https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/CVE-2024-13918.yaml
- https://github.com/advisories/GHSA-546h-56qp-8jmw (Advisory)
Frequently Asked Questions
What is the severity of CVE-2024-13918?
CVE-2024-13918 has been assigned a high severity rating due to its potential for reflected cross-site scripting vulnerabilities.
How do I fix CVE-2024-13918?
To fix CVE-2024-13918, upgrade your Laravel framework to version 11.36.0 or later.
What causes CVE-2024-13918?
CVE-2024-13918 is caused by improper encoding of request parameters in the debug-mode error page.
Which versions of Laravel are affected by CVE-2024-13918?
Laravel framework versions between 11.9.0 and 11.35.1 are affected by CVE-2024-13918.
What should I do if I cannot upgrade to a secure version for CVE-2024-13918?
If unable to upgrade, consider disabling debug mode to mitigate the risk associated with CVE-2024-13918.
- agent/title
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/type
- agent/author
- collector/oss-sec
- source/oss-sec
- alias/CVE-2024-13918
- agent/guess-ai
- agent/software-canonical-lookup
- collector/nvd-cve
- source/NVD
- agent/source
- agent/trending
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-546h-56qp-8jmw
- agent/references
- collector/mitre-cve
- source/MITRE
- collector/github-advisory
- agent/remedy
- agent/severity
- agent/last-modified-date
- agent/event
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- vendor/laravel
- canonical/laravel framework
- package-manager/composer
- canonical/laravel
- version/laravel/11.9.0