Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patched in versions 12.60.0 and 13.10.0.

Impact In Livewire v3 (≤ 3.8.2) and v4 (≤ 4.3.3), a vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the origin of an affected application in specific scenarios. The issue stems from how certain client-side component state is handled. This vulnerability does not affect prior major versions. Exploitation requires user interaction, but does not require authentication or prior access to the application. The issue does not bypass server-side authorisation and grants an attacker no privileges beyond those the affected user already holds.

Patches This issue has been patched in Livewire v3.8.3 and v4.3.4. All users are strongly encouraged to upgrade to these versions or later as soon as possible.

Workarounds There is no known workaround at this time. Users are strongly advised to upgrade to a patched version immediately.

Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading a file with an embedded PHP extension disguised within a double extension such as shell.php.jpg. The PATHINFOFILENAME extraction preserves the inner .php extension in the base name, and on misconfigured Apache or nginx servers that execute any filename containing .php as PHP, the stored file is interpreted as executable code while all MIME type, extension, and aggregate type validation checks pass due to the outer .jpg extension.

Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that allows remote attackers to issue arbitrary HTTP requests from the server by supplying unvalidated caller-controlled URLs to endpoints backed by MediaUploader::fromSource(). Attackers can craft URLs targeting RFC-1918 addresses, loopback interfaces, cloud metadata endpoints, or file:// URIs through RemoteUrlAdapter to reach internal infrastructure, retrieve sensitive files, and exfiltrate cloud credentials such as IAM tokens from instance metadata services.

Laravel Passport provides OAuth2 server support to Laravel. From 13.0.0 to before 13.7.1, there is an Authentication Bypass for clientcredentials tokens. the league/oauth2-server library sets the JWT sub claim to the client identifier (since there's no user). The token guard then passes this value to retrieveById() without validating it's actually a user identifier, potentially resolving an unrelated real user. Any machine-to-machine token can inadvertently authenticate as an actual user. This vulnerability is fixed in 13.7.1.

End of life: 3/17/2028, End of support: 9/30/2027, Latest version: 13.30.1

Laravel Nova 3.7.0 contains a denial of service vulnerability that allows authenticated users to crash the application by manipulating the 'range' parameter. Attackers can send simultaneous requests with an extremely high range value to overwhelm and crash the server.

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERBSCALINGENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds If you cannot upgrade to v1.7.0, you should apply the following mitigations:

Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback. Disable Scaling: If your environment uses only one Reverb node, set REVERBSCALINGENABLED=false to bypass the vulnerable logic entirely.

Credits This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact In Livewire v3 (≤ 3.6.3), a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction.

Patches This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible.

Workarounds There is no known workaround at this time. Users are strongly advised to upgrade to a patched version immediately.

Resources No public references available at this time to avoid exposure. Details will be published after a responsible disclosure window.

Laravel Starter 11.11.0 is vulnerable to Cross Site Scripting (XSS) in the tags feature. Any user with the ability of create or modify tags can inject malicious JavaScript code in the name field.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page #

Link: https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20241209-02LaravelReflectedXSSviaRouteParameterinDebug-ModeErrorPage

Vulnerability Overview ##

The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page.

Identifier : SBA-ADV-20241209-02 Type of Vulnerability : Cross-Site Scripting Software/Product Name : Laravel Framework Vendor : Laravel Holdings Inc. Affected Versions : between 11.9.0 and 11.35.1 Fixed in Version : 11.36.0 CVE ID : CVE-2024-13919 CVSS Vector : CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N CVSS Base Score : 8.0 (High)

Vendor Description ## Laravel is a web application framework with expressive, elegant syntax. Source: <https://github.com/laravel/framework/blob/11.x/README.md>

Impact ##

This vulnerability allows attackers to execute JavaScript code in a user's browser within the origin of the affected web application. The user needs to access the attacker provided link and the web application needs to be in debug-mode (APPDEBUG=true).

Vulnerability Description ##

When the debug mode is active via APPDEBUG=true and the web application returns an error (HTTP status 5XX), an error page is returned. This page contains information about the request that triggered the error. The values in the URL path are embedded in the error page without proper encoding.

The following code snippet shows the sink. The templating engine deactivates HTML-encoding for data passed via {!! !!}.

html <div class="mt-1 rounded border dark:border-gray-800"> <div class="flex items-center"> <span class="min-w-0 flex-grow" style="[…]" > <pre class="scrollbar-hidden mx-5 my-3 overflow-y-hidden text-xs lg:text-sm"><code class="overflow-y-hidden scrollbar-hidden overflow-x-scroll scrollbar-hidden-x">{!! $routeParametersContext !!}</code></pre> </span> </div> </div>

Proof of Concept ##

Prerequisites ###

First, let us make sure that the debug mode is activated ensuring that APPDEBUG=true is set in the .env file. Second, add an endpoint that produces an error, e.g., division by zero.

php <?php

use Illuminate\Support\Facades\Route;

Route::get('/poc-route/{id}', function (string $id) { return 0/0; });

Exploitation ###

In this case the application is available under the origin http://localhost:8000.

By clicking the link http://localhost:8000/poc-route/%3Cimg%20src=''%20onerror='alert(1)'%3E the poc-route function is executed, a division by zero exception is thrown, causing the webserver to respond with a 500 Internal Server Error. An error page is generated containing the following HTML code.

html <div class="flex items-center"> <span class="min-w-0 flex-grow" style="[…]"> <pre class="[…]"> <code class="[…]">{ "id": "<img src="" onerror="alert(1)">" }</code> </pre> </span> </div>

As the id value is not embedded with proper encoding, the browser interprets it as HTML, executes the injected JavaScript code and, therefore, opens an alert.

Recommended Countermeasures ##

If possible upgrade to the fixed version 11.36.0 or above. If you are unable to upgrade, ensure that the application does not run in debug-mode by setting APPDEBUG=false in your configuration.

Timeline ##

2024-11-28 Identified the vulnerability in version 11.34.1 2024-12-09 Initial contact attempt and disclosure of vulnerability to Laravel's security contact 2024-12-13 Security patch was merged 2024-12-14 Contacted Jeremy Angele (@angelej) who independently discovered the vulnerability and submitted the patch to fix it 2024-12-17 Laravel project releases fixed version 11.36.0 2025-02-05 Second attempt to contact Laravel's security contact 2025-03-10 No reaction from Laravel's security contact to all previous contact attempts 2025-03-10 SBA Research assigned CVE-2024-13919 2025-03-10 Public disclosure

References ##

Security Patch: <https://github.com/laravel/framework/pull/53869>

Credits ##

Fabian Funder (SBA Research) Philipp Adelsberger (SBA Research) -----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEL9Wp/yZWFD9OpIt6+7iGL1j3dbIFAmfOwZEACgkQ+7iGL1j3 dbJ8vw//QrtOvJs6Jr0ecibH9/yQamfwHOCV+iNredryHrkzKiqQbscxOtgUQS/i iCKKhK6d0YMn64ZxWCl+DO5sltAtv3ocPdL5f16estJPhKGdo9C944M5AEEO/HvP +gRPExsbhRvrHIq2yCoQmEtbNQw7PezUORIyneWxVpUQW5zxougON5MftSxWsc/d aKsCP5rxd2CatyPiNU77S+zXuVwg/PFiz0HUPAD2fvO0I/MYHbevnJOXsCeeWCPv dO2NRbzK+lQKiK53Rh4BS8xwY1Zhb5CylOVcGan/v7fmt/A/Ia97qH2IVgzXXTXQ twvEuZiSQyEfM5oDZNfSLhWgvcQWryS/KVc2/fqb7m1vUxtP+W2oexfXAXQID7Gh /BOTBZj+4ZU3efToU8TiS0u6U609k8s2cYCVwjrYgubxDH179YkzN8YymOhJ6hea OOOV9rDSaGCvdfM7C+3eBAKJP1bCTUMsQlDy3eu8y0Zq9eOtv3+KoJgEW11g0J5G 7t+1xxxISZOIWwiD7mbBIWiG1Q0B9ZpOwYbd6d5mgIpQoDxJU2Kzw95uMQ6Fu8IC 8U2q/fZ+Dw3j1fPwaSbLyvYV073zQ45g8aC4M9CXuiwdG/wjO3ZSLY1lqzTDz5ZP uoSGRN3dvfsq8XHwkUA/s1pPmqLzeGl58mpBM8zJUuczR9JhSso= =8WPA -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page #

Link: https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20241209-01LaravelReflectedXSSviaRequestParameterinDebug-ModeErrorPage

Vulnerability Overview ##

The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page.

Identifier : SBA-ADV-20241209-01 Type of Vulnerability : Cross-Site Scripting Software/Product Name : Laravel Framework Vendor : Laravel Holdings Inc. Affected Versions : between 11.9.0 and 11.35.1 Fixed in Version : 11.36.0 CVE ID : CVE-2024-13918 CVSS Vector : CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N CVSS Base Score : 8.0 (High)

Vendor Description ## Laravel is a web application framework with expressive, elegant syntax. Source: <https://github.com/laravel/framework/blob/11.x/README.md>

Impact ##

This vulnerability allows attackers to execute JavaScript code in a user's browser within the origin of the affected web application. The user needs to access the attacker provided link and the web application needs to be in debug-mode (APPDEBUG=true).

Vulnerability Description ##

When the debug mode is active via APPDEBUG=true and the web application returns an error (HTTP status 5XX), an error page is returned. This page contains information about the request that triggered the error. The values in the URL parameters and in the request body are embedded in the error page without proper encoding.

The following code snippet shows the sink. The templating engine deactivates HTML-encoding for data passed via {!! !!}.

html <div class="mt-1 rounded border dark:border-gray-800"> <div class="flex items-center"> <span class="min-w-0 flex-grow" style="[…]" > <pre class="scrollbar-hidden mx-5 my-3 overflow-y-hidden text-xs lg:text-sm"><code class="overflow-y-hidden scrollbar-hidden overflow-x-scroll scrollbar-hidden-x">{!! $exception->requestBody() ?: 'No body data' !!}</code></pre> </span> </div> </div>

Proof of Concept ##

Prerequisites ###

First, let us make sure that the debug mode is activated ensuring that APPDEBUG=true is set in the .env file. Second, add an endpoint that produces an error, e.g., division by zero.

php <?php

use Illuminate\Support\Facades\Route;

Route::get('/poc-url', function () { return 0/0; });

Exploitation ###

In this case the application is available under the origin http://localhost:8000.

By clicking the link http://localhost:8000/poc-url?payload=<script>alert(1)</script> the poc-url function is executed, a division by zero exception is thrown, causing the webserver to respond with a 500 Internal Server Error. An error page is generated containing the following HTML code.

html <div class="flex items-center"> <span class="min-w-0 flex-grow" style="[…]"> <pre class="[…]"> <code class="[…] ">{ "payload": "<script>alert(1)</script>" }</code> </pre> </span> </div>

As the payload value is not embedded with proper encoding, the browser interprets it as HTML, executes the injected JavaScript code and, therefore, opens an alert.

Recommended Countermeasures ##

If possible upgrade to the fixed version 11.36.0 or above. If you are unable to upgrade, ensure that the application does not run in debug-mode by setting APPDEBUG=false in your configuration.

Timeline ##

2024-11-28 Identified the vulnerability in version 11.34.1 2024-12-09 Initial contact attempt and disclosure of vulnerability to Laravel's security contact 2024-12-13 Security patch was merged 2024-12-14 Contacted Jeremy Angele (@angelej) who independently discovered the vulnerability and submitted the patch to fix it 2024-12-17 Laravel project releases fixed version 11.36.0 2025-02-05 Second attempt to contact Laravel's security contact 2025-03-10 No reaction from Laravel's security contact to all previous contact attempts 2025-03-10 SBA Research assigned CVE-2024-13918 2025-03-10 Public disclosure

References ##

Security Patch: <https://github.com/laravel/framework/pull/53869>

Credits ##

Fabian Funder (SBA Research) Philipp Adelsberger (SBA Research) -----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEL9Wp/yZWFD9OpIt6+7iGL1j3dbIFAmfOv6AACgkQ+7iGL1j3 dbJqDRAAkxaaCCN+JRJmp2yKha46ScIYQX/Hrh3Ycymrbva3LA3U9I4vxqb2QqSG KhKFPpWNLmhc7VmfIo0kdkgzXwbdtrgomQLASdZij1WFuZTg0tVF7nHOS0Dx5JQO 0RkaJk2A7/Yfp6teuGOscxuDtnUO/XouCcYDv0j+mA39CDxaW0zuh8tKV64J7zcX 0QJVsoDfyIwEbx8IA44O8UCkoGVK0TABcXsh0CXwZKJI0HYK5/SNzg1/bRrfuCgC tjQlEpfB3VU9Gyyxdt1gIUIXUrEp1yTF6rF/2B3bi+zNyeRpp3pka8TvgkeQP8gF b4mLfyWHNoukiXTYW2wr5+0eKEeYOfKu53iRI/n6PK4lC7Rrn4QlCTuVeH7couR7 OIZlYUwPU1HZ+sphqdG7gNdrVFhXA9rsnKpKgCZi9rQNI2zAPP+pxlIVsCYUjreb NKu18bfErUFKHmrCth3NxDeRhHSMXuhkvt+EyUkKaXbRYyRbQaF0H6ODSQboeMXM TkzPR0nySkoQkW26o+vPVcwkKG9VRsVx+gmdF7tnVnd3BcnQXM+JH00SMK+xHs3f Th2zg6NyVfP9+FPjZbm0ajQomJL3mR3CqRd7NHJjH+qup15je5FLmRkhSVnmwu/z AAPB6ZM1IjwkBqtQa8CiQm7x/HNZEkiq3NCIY4hLXPYB82yHALE= =1J2Z -----END PGP SIGNATURE-----

The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page.

The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page.

Laravel is a web application framework. When using wildcard validation to validate a given file or image field (files.), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.

End of life: 2/24/2027, End of support: 8/13/2026, Latest version: 12.69.1

A vulnerability has been discovered in Laravel Pulse that could allow remote code execution through the public remember() method in the Laravel\Pulse\Livewire\Concerns\RemembersQueries trait. This method is accessible via Livewire components and can be exploited to call arbitrary callables within the application.

Impact

An authenticated user with access to Laravel Pulse dashboard can execute arbitrary code by calling any function or static method that meets the following criteria:

- The callable is a function or static method - The callable has no parameters or no strict parameter types

Vulnerable Components

- The remember(callable $query, string $key = '') method in Laravel\Pulse\Livewire\Concerns\RemembersQueries - Affects all Pulse card components that use this trait

Attack Vectors

The vulnerability can be exploited through Livewire component interactions, for example:

php wire:click="remember('\\Illuminate\\Support\\Facades\\Config::all', 'config')"

Credit

Thank you to Jeremy Angele for reporting this vulnerability.

End of life: 3/12/2026, End of support: 9/3/2025, Latest version: 11.56.1

End of life: 3/12/2026, End of support: 9/3/2025, Latest version: 11.56.1

End of life: 2/4/2025, End of support: 8/6/2024, Latest version: 10.50.3

End of life: 2/4/2025, End of support: 8/6/2024, Latest version: 10.50.3

End of life: 1/24/2023, End of support: 7/26/2022, Latest version: 8.83.29

End of life: 1/24/2023, End of support: 7/26/2022, Latest version: 8.83.29

Description

When the registerargcargv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request.

Resolution

The framework now ignores argv values for environment detection on non-cli SAPIs.

End of life: 2/6/2024, End of support: 8/8/2023, Latest version: 9.52.22

End of life: 2/6/2024, End of support: 8/8/2023, Latest version: 9.52.22

In livewire/livewire prior to v2.12.7 and v3.5.2, the file extension of an uploaded file is guessed based on the MIME type. As a result, the actual file extension from the file name is not validated. An attacker can therefore bypass the validation by uploading a file with a valid MIME type (e.g., image/png) and a “.php” file extension. If the following criteria are met, the attacker can carry out an RCE attack:

- Filename is composed of the original file name using $file->getClientOriginalName() - Files stored directly on your server in a public storage disk - Webserver is configured to execute “.php” files

PoC In the following scenario, an attacker could upload a file called shell.php with an image/png MIME type and execute it on the remote server. php class SomeComponent extends Component { use WithFileUploads;

#[Validate('image|extensions:png')] public $file;

public function save() { $this->validate();

$this->file->storeAs( path: 'images', name: $this->file->getClientOriginalName(), options: ['disk' => 'public'], ); } }

Laravel v11.x was discovered to contain an XML External Entity (XXE) vulnerability.

An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/logs/laravel.log. NOTE: this is disputed by multiple third parties because the owner of a Laravel Framework installation can choose to have debugging logs, but needs to set the access control appropriately for the type of data that may be logged.