Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.

Impact When APPDEBUG=true, attacker-controlled input is passed to a Tippy.js tooltip configured with allowHTML: true, enabling DOM-based XSS during mouse hover.

Patches #61381

Laravel MagicLink creates links for authentication without a password or for accessing private content. From 2.0.0 until 2.25.1, MagicLink stores serialized action objects in the magiclinks.action database column and deserializes them through src/MagicLink.php and src/Actions/ResponseAction.php without sufficient integrity protection, while an unsafe legacy unserialize() fallback remains reachable. An attacker who can manipulate database records, such as through a separate SQL injection or compromised administrative access, can insert a malicious serialized object graph containing executable closure behavior; visiting the associated magic link then deserializes the record and can execute arbitrary code in the application process. The affected path is restricted to manipulated action records and does not independently provide database-write access. This issue is fixed in version 2.25.1.

Impact In Livewire v3 (≤ 3.8.2) and v4 (≤ 4.3.3), a vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the origin of an affected application in specific scenarios. The issue stems from how certain client-side component state is handled. This vulnerability does not affect prior major versions. Exploitation requires user interaction, but does not require authentication or prior access to the application. The issue does not bypass server-side authorisation and grants an attacker no privileges beyond those the affected user already holds.

Patches This issue has been patched in Livewire v3.8.3 and v4.3.4. All users are strongly encouraged to upgrade to these versions or later as soon as possible.

Workarounds There is no known workaround at this time. Users are strongly advised to upgrade to a patched version immediately.

Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading a file with an embedded PHP extension disguised within a double extension such as shell.php.jpg. The PATHINFOFILENAME extraction preserves the inner .php extension in the base name, and on misconfigured Apache or nginx servers that execute any filename containing .php as PHP, the stored file is interpreted as executable code while all MIME type, extension, and aggregate type validation checks pass due to the outer .jpg extension.

Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that allows remote attackers to issue arbitrary HTTP requests from the server by supplying unvalidated caller-controlled URLs to endpoints backed by MediaUploader::fromSource(). Attackers can craft URLs targeting RFC-1918 addresses, loopback interfaces, cloud metadata endpoints, or file:// URIs through RemoteUrlAdapter to reach internal infrastructure, retrieve sensitive files, and exfiltrate cloud credentials such as IAM tokens from instance metadata services.

Laravel CRLF injection in default email rule

Impact Authentication Bypass for clientcredentials tokens. the league/oauth2-server library sets the JWT sub claim to the client identifier (since there's no user). The token guard then passes this value to retrieveById() without validating it's actually a user identifier, potentially resolving an unrelated real user. Any machine-to-machine token can inadvertently authenticate as an actual user.

Usage of EnsureClientIsResourceOwner middleware together with Passport::$clientUuids set to false, can result in resolving the user instead, as stated in the documentation.

The underlying OAuth2 server sets the token's sub claim to the client's identifier for client credentials tokens. By default, Passport uses UUIDs for clients, so this cannot collide with a user's integer primary key. However, if you have set Passport::$clientUuids to false, a client credentials token may inadvertently resolve a user whose ID matches the client's ID. In such cases, using this middleware cannot guarantee that the incoming token is a client credentials token.

Patches Patched in v13.7.1

Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? Disallow usage of clientcredentials.

References - https://github.com/laravel/passport/issues/1900 - https://github.com/laravel/passport/pull/1901 - https://github.com/laravel/passport/pull/1902 - https://github.com/thephpleague/oauth2-server/issues/1456#issuecomment-2734989996

End of life: 3/17/2028, End of support: 9/30/2027, Latest version: 13.40.0

Laravel Nova 3.7.0 contains a denial of service vulnerability that allows authenticated users to crash the application by manipulating the 'range' parameter. Attackers can send simultaneous requests with an extremely high range value to overwhelm and crash the server.

Impact

This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (REVERBSCALINGENABLED=true).

The exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.

With horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP’s unserialize() function without restricting which classes could be instantiated.

Risk: Remote Code Execution (RCE)

Patches This vulnerability is fixed in Laravel Reverb v1.7.0.

Update your dependency to laravel/reverb: ^1.7.0 immediately.

Workarounds If you cannot upgrade to v1.7.0, you should apply the following mitigations:

Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback. Disable Scaling: If your environment uses only one Reverb node, set REVERBSCALINGENABLED=false to bypass the vulnerable logic entirely.

Credits This vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad

Impact In Livewire v3 (≤ 3.6.3), a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction.

Patches This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible.

Workarounds There is no known workaround at this time. Users are strongly advised to upgrade to a patched version immediately.

Resources No public references available at this time to avoid exposure. Details will be published after a responsible disclosure window.

Laravel Starter 11.11.0 is vulnerable to Cross Site Scripting (XSS) in the tags feature. Any user with the ability of create or modify tags can inject malicious JavaScript code in the name field.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page #

Link: https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20241209-02LaravelReflectedXSSviaRouteParameterinDebug-ModeErrorPage

Vulnerability Overview ##

The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page.

Identifier : SBA-ADV-20241209-02 Type of Vulnerability : Cross-Site Scripting Software/Product Name : Laravel Framework Vendor : Laravel Holdings Inc. Affected Versions : between 11.9.0 and 11.35.1 Fixed in Version : 11.36.0 CVE ID : CVE-2024-13919 CVSS Vector : CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N CVSS Base Score : 8.0 (High)

Vendor Description ## Laravel is a web application framework with expressive, elegant syntax. Source: <https://github.com/laravel/framework/blob/11.x/README.md>

Impact ##

This vulnerability allows attackers to execute JavaScript code in a user's browser within the origin of the affected web application. The user needs to access the attacker provided link and the web application needs to be in debug-mode (APPDEBUG=true).

Vulnerability Description ##

When the debug mode is active via APPDEBUG=true and the web application returns an error (HTTP status 5XX), an error page is returned. This page contains information about the request that triggered the error. The values in the URL path are embedded in the error page without proper encoding.

The following code snippet shows the sink. The templating engine deactivates HTML-encoding for data passed via {!! !!}.

html <div class="mt-1 rounded border dark:border-gray-800"> <div class="flex items-center"> <span class="min-w-0 flex-grow" style="[…]" > <pre class="scrollbar-hidden mx-5 my-3 overflow-y-hidden text-xs lg:text-sm"><code class="overflow-y-hidden scrollbar-hidden overflow-x-scroll scrollbar-hidden-x">{!! $routeParametersContext !!}</code></pre> </span> </div> </div>

Proof of Concept ##

Prerequisites ###

First, let us make sure that the debug mode is activated ensuring that APPDEBUG=true is set in the .env file. Second, add an endpoint that produces an error, e.g., division by zero.

php <?php

use Illuminate\Support\Facades\Route;

Route::get('/poc-route/{id}', function (string $id) { return 0/0; });

Exploitation ###

In this case the application is available under the origin http://localhost:8000.

By clicking the link http://localhost:8000/poc-route/%3Cimg%20src=''%20onerror='alert(1)'%3E the poc-route function is executed, a division by zero exception is thrown, causing the webserver to respond with a 500 Internal Server Error. An error page is generated containing the following HTML code.

html <div class="flex items-center"> <span class="min-w-0 flex-grow" style="[…]"> <pre class="[…]"> <code class="[…]">{ "id": "<img src="" onerror="alert(1)">" }</code> </pre> </span> </div>

As the id value is not embedded with proper encoding, the browser interprets it as HTML, executes the injected JavaScript code and, therefore, opens an alert.

Recommended Countermeasures ##

If possible upgrade to the fixed version 11.36.0 or above. If you are unable to upgrade, ensure that the application does not run in debug-mode by setting APPDEBUG=false in your configuration.

Timeline ##

2024-11-28 Identified the vulnerability in version 11.34.1 2024-12-09 Initial contact attempt and disclosure of vulnerability to Laravel's security contact 2024-12-13 Security patch was merged 2024-12-14 Contacted Jeremy Angele (@angelej) who independently discovered the vulnerability and submitted the patch to fix it 2024-12-17 Laravel project releases fixed version 11.36.0 2025-02-05 Second attempt to contact Laravel's security contact 2025-03-10 No reaction from Laravel's security contact to all previous contact attempts 2025-03-10 SBA Research assigned CVE-2024-13919 2025-03-10 Public disclosure

References ##

Security Patch: <https://github.com/laravel/framework/pull/53869>

Credits ##

Fabian Funder (SBA Research) Philipp Adelsberger (SBA Research) -----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEL9Wp/yZWFD9OpIt6+7iGL1j3dbIFAmfOwZEACgkQ+7iGL1j3 dbJ8vw//QrtOvJs6Jr0ecibH9/yQamfwHOCV+iNredryHrkzKiqQbscxOtgUQS/i iCKKhK6d0YMn64ZxWCl+DO5sltAtv3ocPdL5f16estJPhKGdo9C944M5AEEO/HvP +gRPExsbhRvrHIq2yCoQmEtbNQw7PezUORIyneWxVpUQW5zxougON5MftSxWsc/d aKsCP5rxd2CatyPiNU77S+zXuVwg/PFiz0HUPAD2fvO0I/MYHbevnJOXsCeeWCPv dO2NRbzK+lQKiK53Rh4BS8xwY1Zhb5CylOVcGan/v7fmt/A/Ia97qH2IVgzXXTXQ twvEuZiSQyEfM5oDZNfSLhWgvcQWryS/KVc2/fqb7m1vUxtP+W2oexfXAXQID7Gh /BOTBZj+4ZU3efToU8TiS0u6U609k8s2cYCVwjrYgubxDH179YkzN8YymOhJ6hea OOOV9rDSaGCvdfM7C+3eBAKJP1bCTUMsQlDy3eu8y0Zq9eOtv3+KoJgEW11g0J5G 7t+1xxxISZOIWwiD7mbBIWiG1Q0B9ZpOwYbd6d5mgIpQoDxJU2Kzw95uMQ6Fu8IC 8U2q/fZ+Dw3j1fPwaSbLyvYV073zQ45g8aC4M9CXuiwdG/wjO3ZSLY1lqzTDz5ZP uoSGRN3dvfsq8XHwkUA/s1pPmqLzeGl58mpBM8zJUuczR9JhSso= =8WPA -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page #

Link: https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20241209-01LaravelReflectedXSSviaRequestParameterinDebug-ModeErrorPage

Vulnerability Overview ##

The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page.

Identifier : SBA-ADV-20241209-01 Type of Vulnerability : Cross-Site Scripting Software/Product Name : Laravel Framework Vendor : Laravel Holdings Inc. Affected Versions : between 11.9.0 and 11.35.1 Fixed in Version : 11.36.0 CVE ID : CVE-2024-13918 CVSS Vector : CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N CVSS Base Score : 8.0 (High)

Vendor Description ## Laravel is a web application framework with expressive, elegant syntax. Source: <https://github.com/laravel/framework/blob/11.x/README.md>

Impact ##

This vulnerability allows attackers to execute JavaScript code in a user's browser within the origin of the affected web application. The user needs to access the attacker provided link and the web application needs to be in debug-mode (APPDEBUG=true).

Vulnerability Description ##

When the debug mode is active via APPDEBUG=true and the web application returns an error (HTTP status 5XX), an error page is returned. This page contains information about the request that triggered the error. The values in the URL parameters and in the request body are embedded in the error page without proper encoding.

The following code snippet shows the sink. The templating engine deactivates HTML-encoding for data passed via {!! !!}.

html <div class="mt-1 rounded border dark:border-gray-800"> <div class="flex items-center"> <span class="min-w-0 flex-grow" style="[…]" > <pre class="scrollbar-hidden mx-5 my-3 overflow-y-hidden text-xs lg:text-sm"><code class="overflow-y-hidden scrollbar-hidden overflow-x-scroll scrollbar-hidden-x">{!! $exception->requestBody() ?: 'No body data' !!}</code></pre> </span> </div> </div>

Proof of Concept ##

Prerequisites ###

First, let us make sure that the debug mode is activated ensuring that APPDEBUG=true is set in the .env file. Second, add an endpoint that produces an error, e.g., division by zero.

php <?php

use Illuminate\Support\Facades\Route;

Route::get('/poc-url', function () { return 0/0; });

Exploitation ###

In this case the application is available under the origin http://localhost:8000.

By clicking the link http://localhost:8000/poc-url?payload=<script>alert(1)</script> the poc-url function is executed, a division by zero exception is thrown, causing the webserver to respond with a 500 Internal Server Error. An error page is generated containing the following HTML code.

html <div class="flex items-center"> <span class="min-w-0 flex-grow" style="[…]"> <pre class="[…]"> <code class="[…] ">{ "payload": "<script>alert(1)</script>" }</code> </pre> </span> </div>

As the payload value is not embedded with proper encoding, the browser interprets it as HTML, executes the injected JavaScript code and, therefore, opens an alert.

Recommended Countermeasures ##

If possible upgrade to the fixed version 11.36.0 or above. If you are unable to upgrade, ensure that the application does not run in debug-mode by setting APPDEBUG=false in your configuration.

Timeline ##

2024-11-28 Identified the vulnerability in version 11.34.1 2024-12-09 Initial contact attempt and disclosure of vulnerability to Laravel's security contact 2024-12-13 Security patch was merged 2024-12-14 Contacted Jeremy Angele (@angelej) who independently discovered the vulnerability and submitted the patch to fix it 2024-12-17 Laravel project releases fixed version 11.36.0 2025-02-05 Second attempt to contact Laravel's security contact 2025-03-10 No reaction from Laravel's security contact to all previous contact attempts 2025-03-10 SBA Research assigned CVE-2024-13918 2025-03-10 Public disclosure

References ##

Security Patch: <https://github.com/laravel/framework/pull/53869>

Credits ##

Fabian Funder (SBA Research) Philipp Adelsberger (SBA Research) -----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEL9Wp/yZWFD9OpIt6+7iGL1j3dbIFAmfOv6AACgkQ+7iGL1j3 dbJqDRAAkxaaCCN+JRJmp2yKha46ScIYQX/Hrh3Ycymrbva3LA3U9I4vxqb2QqSG KhKFPpWNLmhc7VmfIo0kdkgzXwbdtrgomQLASdZij1WFuZTg0tVF7nHOS0Dx5JQO 0RkaJk2A7/Yfp6teuGOscxuDtnUO/XouCcYDv0j+mA39CDxaW0zuh8tKV64J7zcX 0QJVsoDfyIwEbx8IA44O8UCkoGVK0TABcXsh0CXwZKJI0HYK5/SNzg1/bRrfuCgC tjQlEpfB3VU9Gyyxdt1gIUIXUrEp1yTF6rF/2B3bi+zNyeRpp3pka8TvgkeQP8gF b4mLfyWHNoukiXTYW2wr5+0eKEeYOfKu53iRI/n6PK4lC7Rrn4QlCTuVeH7couR7 OIZlYUwPU1HZ+sphqdG7gNdrVFhXA9rsnKpKgCZi9rQNI2zAPP+pxlIVsCYUjreb NKu18bfErUFKHmrCth3NxDeRhHSMXuhkvt+EyUkKaXbRYyRbQaF0H6ODSQboeMXM TkzPR0nySkoQkW26o+vPVcwkKG9VRsVx+gmdF7tnVnd3BcnQXM+JH00SMK+xHs3f Th2zg6NyVfP9+FPjZbm0ajQomJL3mR3CqRd7NHJjH+qup15je5FLmRkhSVnmwu/z AAPB6ZM1IjwkBqtQa8CiQm7x/HNZEkiq3NCIY4hLXPYB82yHALE= =1J2Z -----END PGP SIGNATURE-----

Laravel has a File Validation Bypass

End of life: 2/24/2027, End of support: 8/13/2026, Latest version: 12.71.0

A vulnerability has been discovered in Laravel Pulse that could allow remote code execution through the public remember() method in the Laravel\Pulse\Livewire\Concerns\RemembersQueries trait. This method is accessible via Livewire components and can be exploited to call arbitrary callables within the application.

Impact

An authenticated user with access to Laravel Pulse dashboard can execute arbitrary code by calling any function or static method that meets the following criteria:

- The callable is a function or static method - The callable has no parameters or no strict parameter types

Vulnerable Components

- The remember(callable $query, string $key = '') method in Laravel\Pulse\Livewire\Concerns\RemembersQueries - Affects all Pulse card components that use this trait

Attack Vectors

The vulnerability can be exploited through Livewire component interactions, for example:

php wire:click="remember('\\Illuminate\\Support\\Facades\\Config::all', 'config')"

Credit

Thank you to Jeremy Angele for reporting this vulnerability.

Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page

Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page

End of life: 3/12/2026, End of support: 9/3/2025, Latest version: 11.57.1

End of life: 3/12/2026, End of support: 9/3/2025, Latest version: 11.57.1

End of life: 2/4/2025, End of support: 8/6/2024, Latest version: 10.50.4

End of life: 2/4/2025, End of support: 8/6/2024, Latest version: 10.50.4

End of life: 1/24/2023, End of support: 7/26/2022, Latest version: 8.83.29

End of life: 1/24/2023, End of support: 7/26/2022, Latest version: 8.83.29

Description

When the registerargcargv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request.

Resolution

The framework now ignores argv values for environment detection on non-cli SAPIs.

End of life: 2/6/2024, End of support: 8/8/2023, Latest version: 9.52.22

End of life: 2/6/2024, End of support: 8/8/2023, Latest version: 9.52.22