Laravel Framework RCE Vulnerability
Affected range
ECOSYSTEM: introduced 0; last affected 5.5.40ECOSYSTEM: introduced 5.6.0; fixed 5.6.30>=5.6.0,<=5.6.29|<=5.5.40Fixed versions: 5.6.30
Vulnerability intelligence Composer
laravel/framework
The Laravel Framework.
Composer latest 13.32.0 MIT
Evidence path
Version, exploitation, severity
RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.
1
Latest version
13.32.0
No matching published advisory returned
2
Known exploitation
No KEV match
Checked by exact CVE identifier
3
Highest advisory severity
Critical
26 active advisories
Check an exact version
The registry confirms the version, then OSV checks advisories for that exact value.
Published records
Advisories
GHSA-qm5c-m76r-2hfr critical
Laravel RCE vulnerability in "cookie" session driver
Affected range
ECOSYSTEM: introduced 4.1.0; fixed 6.18.31ECOSYSTEM: introduced 7.0.0; fixed 7.22.4>=5.5.0,<=5.5.49|>=6.0.0,<6.18.34|>=7.0.0,<7.23.2Fixed versions: 6.18.31, 7.22.4
GHSA-pfg4-p438-p874 critical
Laravel Framework Deserialization Vulnerability
Affected range
ECOSYSTEM: introduced 5.7.0; fixed 6.20.44>=5.7.0,<6.20.44Fixed versions: 6.20.44
GHSA-5vg9-5847-vvmq high
Laravel Framework: CRLF injection in default email rule
Affected range
ECOSYSTEM: introduced 13.0.0; fixed 13.10.0ECOSYSTEM: introduced 0; fixed 12.60.0<12.60.0|>=13.0.0,<=13.9.0>=9.0.0,<10.0.0|>=10.0.0,<11.0.0|>=11.0.0,<12.0.0|>=12.0.0,<12.60.0|>=13.0.0,<13.10.0Fixed versions: 13.10.0, 12.60.0
GHSA-3p32-j457-pg5x high
Query Binding Exploitation
Affected range
ECOSYSTEM: introduced 8.0.0; fixed 8.22.1ECOSYSTEM: introduced 6.0.0; fixed 6.20.11ECOSYSTEM: introduced 7.0.0; fixed 7.30.2>=6.0.0,<6.20.11|>=7.0.0,<7.30.2|>=8.0.0,<8.22.1Fixed versions: 8.22.1, 6.20.11, 7.30.2
GHSA-gv7v-rgg6-548h high
Laravel environment manipulation via query string
Affected range
ECOSYSTEM: introduced 0; fixed 6.20.45ECOSYSTEM: introduced 7.0.0; fixed 7.30.7ECOSYSTEM: introduced 8.0.0; fixed 8.83.28ECOSYSTEM: introduced 9.0.0; fixed 9.52.17ECOSYSTEM: introduced 10.0.0; fixed 10.48.23Fixed versions: 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, 11.31.0
GHSA-x7p5-p2c9-phvg high
Unexpected database bindings
Affected range
ECOSYSTEM: introduced 0; fixed 6.20.14ECOSYSTEM: introduced 7.0.0; fixed 7.30.4ECOSYSTEM: introduced 8.0.0; fixed 8.24.0>=4.0.0,<4.0.99|>=4.1.0,<4.1.29Fixed versions: 6.20.14, 7.30.4, 8.24.0
GHSA-4mg9-vhxq-vm7j high
SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database
Affected range
ECOSYSTEM: introduced 8.0.0; fixed 8.40.0ECOSYSTEM: introduced 0; fixed 6.20.26>=4.0.0,<=4.0.11|>=4.1.0,<=4.1.31|>=4.2.0,<=4.2.22|>=5.0.0,<=5.0.35|>=5.1.0,<=5.1.46|>=5.2.0,<=5.2.45|>=5.3.0,<=5.3.31|>=5.4.0,<=5.4.36|>=5.5.0,<5.5.40|>=5.6.0,<5.6.15Fixed versions: 8.40.0, 6.20.26
GHSA-wq8p-mqvg-2p5h high
laravel framework SQL Injection via limit and offset functions
Affected range
ECOSYSTEM: introduced 6.0.0; fixed 6.20.26ECOSYSTEM: introduced 7.0.0; fixed 7.30.5ECOSYSTEM: introduced 8.0.0; fixed 8.40.0>=4.0.0,<4.0.99|>=4.1.0,<4.1.26Fixed versions: 6.20.26, 7.30.5, 8.40.0
GHSA-6jvx-8ch9-j2jr high
Laravel Cookie serialization vulnerability
Affected range
ECOSYSTEM: introduced 5.5.0; fixed 5.6.30>=6.0.0,<6.20.14|>=7.0.0,<7.30.4|>=8.0.0,<8.24.0Fixed versions: 5.6.30
GHSA-jwvj-pwww-3mj5 high
laravel framework Unexpected database bindings via requests
Affected range
ECOSYSTEM: introduced 6.0.0; fixed 6.20.14ECOSYSTEM: introduced 7.0.0; fixed 7.30.4ECOSYSTEM: introduced 8.0.0; fixed 8.24.0>=4.0.0,<=4.0.11|>=4.1.0,<=4.1.31|>=4.2.0,<=4.2.22|>=5.0.0,<=5.0.35|>=5.1.0,<=5.1.46|>=5.2.0,<=5.2.45|>=5.3.0,<=5.3.31|>=5.4.0,<=5.4.36|>=5.5.0,<5.5.42|>=5.6.0,<5.6.30Fixed versions: 6.20.14, 7.30.4, 8.24.0
GHSA-w2pm-r78h-4m7v high
OS Command Injection in Laravel Framework
Affected range
ECOSYSTEM: introduced 0; fixed 5.8.17<5.8.17Fixed versions: 5.8.17
GHSA-w68r-5p45-5rqp high
Improper Input Validation in Laravel
Affected range
ECOSYSTEM: introduced 0; fixed 6.18.35ECOSYSTEM: introduced 7.0.0; fixed 7.24.0>=7.0.0,<7.24.0|<6.18.35Fixed versions: 6.18.35, 7.24.0
GHSA-crmm-hgp2-wgrp moderate
Laravel Framework: Temporary Signed URL Path Confusion
Affected range
ECOSYSTEM: introduced 13.0.0; fixed 13.12.0ECOSYSTEM: introduced 0; fixed 12.61.1<12.61.1|>=13.0.0,<13.12.0Fixed versions: 13.12.0, 12.61.1
GHSA-78fx-h6xr-vch4 moderate
Laravel has a File Validation Bypass
Affected range
ECOSYSTEM: introduced 12.0.0; fixed 12.1.1ECOSYSTEM: introduced 11.0.0; fixed 11.44.1ECOSYSTEM: introduced 0; fixed 10.48.29<10.48.29|>=11.0.0,<11.44.1|>=12.0.0,<12.1.1Fixed versions: 12.1.1, 11.44.1, 10.48.29
GHSA-66hf-2p6w-jqfw moderate
Laravel Framework XSS in Blade templating engine
Affected range
ECOSYSTEM: introduced 0; fixed 6.20.42ECOSYSTEM: introduced 7.0.0; fixed 7.30.6ECOSYSTEM: introduced 8.0.0; fixed 8.75.0<6.20.42|>=7.0.0,<7.30.6|>=8.0.0,<8.75.0Fixed versions: 6.20.42, 7.30.6, 8.75.0
GHSA-83wp-f5c3-hqqr moderate
Laravel framework susceptible to reflected cross-site scripting
Affected range
ECOSYSTEM: introduced 11.9.0; fixed 11.36.0>=11.9.0,<11.36.0Fixed versions: 11.36.0
GHSA-546h-56qp-8jmw moderate
Laravel framework susceptible to reflected cross-site scripting
Affected range
ECOSYSTEM: introduced 11.9.0; fixed 11.36.0>=11.9.0,<11.36.0Fixed versions: 11.36.0
GHSA-vr95-p7q6-8m9q moderate
Laravel Cross-site Scripting (XSS) vulnerability in blade templating
Affected range
ECOSYSTEM: introduced 7.0.0; fixed 7.1.2>=4.1.0,<=4.1.99999|>=4.2.0,<=4.2.99999|>=5.0.0,<=5.0.99999|>=5.1.0,<=5.1.99999|>=5.2.0,<=5.2.99999|>=5.3.0,<=5.3.99999|>=5.4.0,<=5.4.99999|>=5.5.0,<=5.5.49|>=5.6.0,<=5.6.99999|>=5.7.0,<=5.7.99999|>=5.8.0,<=5.8.99999|>=6.0.0,<6.18.31|>=7.0.0,<7.22.4Fixed versions: 7.1.2
GHSA-rj3w-99gc-8j58 moderate
Laravel Risk of mass-assignment vulnerabilities
Affected range
ECOSYSTEM: introduced 4.0.0; fixed 4.1.29>=4.0.0,<4.1.29Fixed versions: 4.1.29
GHSA-7852-w36x-6mf6 moderate
Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior
Affected range
ECOSYSTEM: introduced 0; fixed 5.5.40ECOSYSTEM: introduced 5.6.0; fixed 5.6.15>=6.0.0,<6.20.26|>=7.0.0,<7.30.5|>=8.0.0,<8.40.0Fixed versions: 5.5.40, 5.6.15
GHSA-44pg-c29v-hp6r moderate
Laravel Guard bypass in Eloquent models
Affected range
ECOSYSTEM: introduced 5.5.0; last affected 5.5.49ECOSYSTEM: introduced 6.0.0; fixed 6.18.34ECOSYSTEM: introduced 7.0.0; fixed 7.23.2>=7.0.0,<7.1.2Fixed versions: 6.18.34, 7.23.2
GHSA-p62r-7637-3wwc moderate
Laravel Hijacked authentication cookies vulnerability
Affected range
ECOSYSTEM: introduced 4.0.0; fixed 4.1.26>=4.0.0,<4.1.26Fixed versions: 4.1.26
GHSA-rc8x-jrrc-frfv moderate
Laravel does not properly constrain the host portion of a password-reset URL
Affected range
ECOSYSTEM: introduced 5.3.0; last affected 5.3.31ECOSYSTEM: introduced 5.4.0; fixed 5.4.22>=5.3.0,<=5.3.31|>=5.4.0,<5.4.22Fixed versions: 5.4.22
GHSA-c2v7-j5gq-wcq4 moderate
Laravel Sensitive Data Exposure
Affected range
ECOSYSTEM: introduced 0; fixed 5.5.10>=4.1.26,<=4.1.31|>=4.2.0,<=4.2.22|>=5.0.0,<=5.0.35|>=5.1.0,<=5.1.46|>=5.2.0,<=5.2.45|>=5.3.0,<=5.3.31|>=5.4.0,<=5.4.36|>=5.5.0,<5.5.10Fixed versions: 5.5.10
Show 1 more advisories
PKSA-p3rx-dfwp-73ny Image upload bypass