CVE-2026-48019: CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay

Published Sep 4, 2026
·
Updated

Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patched in versions 12.60.0 and 13.10.0.

Affected Software

1 affected component
Laravel Laravel<12.60.0, <13.10.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Laravel to a version that resolves this vulnerability.

    Fixed in 12.60.0
  2. Upgrade

    Upgrade Laravel to a version that resolves this vulnerability.

    Fixed in 13.10.0

Event History

Sep 4, 2026
CVE Published
via MITRE·10:11 PM
Data Sourced
via MITRE·10:11 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Which applications are exposed to this issue?

Applications using Laravel versions before 12.60.0 or 13.10.0 are exposed if they send outbound email to addresses supplied by users. Exploitation depends on the interaction between Laravel email validation and Symfony Mailer/Symfony Mime handling of certain character sequences.

2

Does an attacker need an account or user interaction to exploit it?

No. The vulnerability can be exploited by an unauthenticated attacker and does not require user interaction, provided the application sends mail to attacker-controlled or otherwise user-supplied recipient addresses.

3

What versions contain the fix?

Laravel 12.60.0 and 13.10.0 include the patch. Versions prior to those releases are affected according to the advisory.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203