Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patched in versions 12.60.0 and 13.10.0.
Laravel is a web application framework. When using wildcard validation to validate a given file or image field (files.), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.
Laravel Ignition contains a file upload vulnerability that allows unauthenticated remote attackers to execute malicious code due to insecure usage of filegetcontents() and fileputcontents().
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.
End of life: 3/17/2028, End of support: 9/30/2027, Latest version: 13.31.0
End of life: 2/24/2027, End of support: 8/13/2026, Latest version: 12.69.2
End of life: 3/12/2026, End of support: 9/3/2025, Latest version: 11.56.1
End of life: 3/12/2026, End of support: 9/3/2025, Latest version: 11.56.1
End of life: 2/4/2025, End of support: 8/6/2024, Latest version: 10.50.3
End of life: 2/4/2025, End of support: 8/6/2024, Latest version: 10.50.3
End of life: 2/6/2024, End of support: 8/8/2023, Latest version: 9.52.22
End of life: 2/6/2024, End of support: 8/8/2023, Latest version: 9.52.22
In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in src/Illuminate/Foundation/Console/KeyGenerateCommand.php, which uses fileputcontents without restricting the .env permissions. The .env filename is not used exclusively by Laravel framework.
Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers to conduct phishing attacks by specifying an attacker-controlled host.