CVE-2026-48019: CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay
Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patched in versions 12.60.0 and 13.10.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Laravelto a version that resolves this vulnerability.Fixed in 12.60.0 - Upgrade
Upgrade
Laravelto a version that resolves this vulnerability.Fixed in 13.10.0
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using Laravel versions before 12.60.0 or 13.10.0 are exposed if they send outbound email to addresses supplied by users. Exploitation depends on the interaction between Laravel email validation and Symfony Mailer/Symfony Mime handling of certain character sequences.
Does an attacker need an account or user interaction to exploit it?
No. The vulnerability can be exploited by an unauthenticated attacker and does not require user interaction, provided the application sends mail to attacker-controlled or otherwise user-supplied recipient addresses.
What versions contain the fix?
Laravel 12.60.0 and 13.10.0 include the patch. Versions prior to those releases are affected according to the advisory.