Skip to content
Patch Next
Sign inAdd to your agent

← Actionable
High, CVSS 8.1Exploited · CISA KEV

Laravel Framework RCE Vulnerability

CVE-2018-15133GHSA-qvqm-h22r-4cp9

What to do

Partial vendor fix. Follow the primary source's mitigation guidance and check back for a fix.

This page has no inventory attached, so it cannot say whether you are affected. A vendor fix is not proof that your deployment is fixed.

Add to your agent

Affected packages

Sources

Severity and exploitation
Exploitation
Confirmed: listed in the CISA Known Exploited Vulnerabilities catalog.
CVSS
8.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
  • CVE-2018-15133: 76.57% estimated exploitation activity in the next 30 days; percentile 99.54 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.
Source description

As published by the source; long descriptions are shortened.

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.

Dates and revisions
Published by the source
Last modified by the source
Source last checked
  1. Revision 1 · created ·

    Published from ghsa record GHSA-qvqm-h22r-4cp9

Agent brief

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2018-15133

Advisory: Laravel Framework RCE Vulnerability
IDs: CVE-2018-15133, GHSA-qvqm-h22r-4cp9
Record: https://patchnext.com/advisories/cve-2018-15133 (revision 1, source checked 26 Oct 2026, 14:29 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 8.1)
Exploitation: confirmed: listed in the CISA Known Exploited Vulnerabilities catalog.
Vendor response: Partial vendor fix; fixed versions by package: laravel/framework 5.6.30. A vendor fix does not mean a deployment is fixed.

## Affected components
- Packagist laravel/framework: affected <= 5.5.40; >= 5.6.0, <= 5.6.29; fixed in 5.6.30

## Suggested inspection (read-only)
- Packagist laravel/framework: check the installed version with your package manager.

## Supported action
No complete vendor fix is recorded. Follow the primary source's mitigation guidance and check this record again before closing anything.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on laravel/framework.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-qvqm-h22r-4cp9 (GitHub-reviewed advisory GHSA-qvqm-h22r-4cp9 lists affected ranges: Packagist laravel/framework >=0 =5.6.0 <=5.6.29)
- Verified: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CISA added CVE-2018-15133 to the Known Exploited Vulnerabilities catalog on 2024-01-16.)

Commands are suggestions: review each one before running it.

Loading voting…