Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
28 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Laravel's built-in TokenGuard, when configured with a standard token-based API guard, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. Under certain database configurations (MySQL/MariaDB) an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected. Impact An unauthenticated attacker may authenticate as another user without possessing that user's API token, leading to authentication bypass and account takeover on any route protected by the affected guard.
Recommended action: Upgrade to 13.29.0 or 12.68.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data. Impact A user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applications.
Recommended action: Upgrade to 13.27.0 or 12.68.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact When APPDEBUG=true, attacker-controlled input is passed to a Tippy.js tooltip configured with allowHTML: true, enabling DOM-based XSS during mouse hover. Patches #61381
Recommended action: Upgrade to 13.30.0 or 12.69.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A vulnerability in Laravel's local filesystem driver allows temporary signed URLs to be parsed ambiguously, potentially misrouting requests and bypassing expiration enforcement. Under certain conditions, a generated temporary signed URL can be interpreted differently by the server than intended at signing time. This may cause requests to resolve to an unintended resource, and can prevent expiration from being enforced, allowing expired URLs to remain valid indefinitely. Impact - Expired temporary URLs may continue to be accepted - Requests may resolve to a different resource than the one that was signed - The upload variant may allow writes to reach an unintended destination
Recommended action: Upgrade to 13.12.0 or 12.61.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. Description Laravel applications that send email to addresses provided by users — for example during authentication flows or contact forms — may be vulnerable to manipulation of outbound mail content if the address is not adequately sanitized before it reaches the mail transport layer. An attacker who can supply an email address to such a flow may, under certain conditions, be able to influence the content of emails sent by the application, cause those emails to be delivered to unintended recipients, or cause the application's mail server to send unintended messages. Impact Affected applications may be exposed to unauthorized access and mail relay abuse. The severity depends on what the…
Recommended action: Upgrade to 13.10.0 or 12.60.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page.
Recommended action: Upgrade to 11.36.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page.
Recommended action: Upgrade to 11.36.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When using wildcard validation to validate a given file or image field array (files.), a user-crafted malicious request could potentially bypass the validation rules.
Recommended action: Upgrade to 12.1.1, 11.44.1 or 10.48.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
9.52.1711.31.010.48.238.83.287.30.76.20.45· Vendor fix available
Issue
When the registerargcargv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. Resolution The framework now ignores argv values for environment detection on non-cli SAPIs.
Recommended action: Upgrade to 11.31.0, 10.48.23, 9.52.17 or 3 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Those using SQL Server with Laravel and allowing user input to be passed directly to the limit and offset functions are vulnerable to SQL injection. Other database drivers such as MySQL and Postgres are not affected by this vulnerability. Patches This problem has been patched on Laravel versions 6.20.26, 7.30.5, and 8.40.0. Workarounds You may workaround this vulnerability by ensuring that only integers are passed to the limit and offset functions, as well as the skip and take functions.
Recommended action: Upgrade to 8.40.0, 7.30.5 or 6.20.26 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This is a follow-up to the security advisory https://github.com/laravel/framework/security/advisories/GHSA-3p32-j457-pg5x which addresses a few additional edge cases. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query. In some situations, this will simply lead to no results being returned by the query builder; however, it is possible certain queries could be affected in a way that causes the query to return unexpected results.
Recommended action: Upgrade to 8.24.0, 7.30.4 or 6.20.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In laravel releases before 6.18.34 and 7.23.2. It was possible to mass assign Eloquent attributes that included the model's table name: When doing so, Eloquent would remove the table name from the attribute for you. This was a "convenience" feature of Eloquent and was not documented. However, when paired with validation, this can lead to unexpected and unvalidated values being saved to the database. For this reason, we have removed the automatic stripping of table names from mass-asignment operations so that the attributes go through the typical "fillable" / "guarded" logic. Any attributes containing table names that are not explicitly declared as fillable will be discarded. This security release will be a breaking change for applications that were relying on the undocumented table name stripping during mass assignment. Since this feature was relatively unknown and undocumented, we expect the vast majority of Laravel applications to be able to upgrade without issues.
Recommended action: Upgrade to 7.23.2 or 6.18.34 by release line; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Applications using the "cookie" session driver that were also exposing an encryption oracle via their application were vulnerable to remote code execution. An encryption oracle is a mechanism where arbitrary user input is encrypted and the encrypted string is later displayed or exposed to the user. This combination of scenarios lets the user generate valid Laravel signed encryption strings for any plain-text string, thus allowing them to craft Laravel session payloads when an application is using the "cookie" driver.
Recommended action: Upgrade to 7.22.4 or 6.18.31 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Laravel 7.1.2 addresses a possible XSS related attack vector in the Laravel 7.x Blade Component tag attributes when users are allowed to dictate the value of attributes. All Laravel 7.x users are encouraged to upgrade as soon as possible.
Recommended action: Upgrade to 7.1.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Laravel 5.6.30 is a security release of Laravel and is recommended as an immediate upgrade for all users. Laravel 5.6.30 also contains a breaking change to cookie encryption and serialization logic. Refer to laravel advisory for more details and read the notes carefully when upgrading your application.
Recommended action: Upgrade to 5.6.30 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Laravel Encrypter component is susceptible to a vulnerability that may result in decryption failure, leading to an unexpected return of false. Exploiting this issue requires the attacker to manipulate the encrypted payload before decryption. When combined with weak type comparisons in the application's code, such as the example below:
Recommended action: Upgrade to 5.6.15 or 5.5.40 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Laravel 4.1.26 introduces security improvements for "remember me" cookies. Before this update, if a remember cookie was hijacked by another malicious user, the cookie would remain valid for a long period of time, even after the true owner of the account reset their password, logged out, etc. This change requires the addition of a new remembertoken column to your users (or equivalent) database table. After this change, a fresh token will be assigned to the user each time they login to your application. The token will also be refreshed when the user logs out of the application. The implications of this change are: if a "remember me" cookie is hijacked, simply logging out of the application will invalidate the cookie.
Recommended action: Upgrade to 4.1.26 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Laravel 4.1.29 improves the column quoting for all database drivers. This protects your application from some mass assignment vulnerabilities when not using the fillable property on models. If you are using the fillable property on your models to protect against mass assignment, your application is not vulnerable. However, if you are using guarded and are passing a user controlled array into an "update" or "save" type function, you should upgrade to 4.1.29 immediately as your application may be at risk of mass assignment.
Recommended action: Upgrade to 4.1.29 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers to conduct phishing attacks by specifying an attacker-controlled host.
Recommended action: Upgrade to 5.4.22; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Laravel before 5.5.10 mishandles the rememberme token verification process because DatabaseUserProvider does not have constant-time token comparison.
Recommended action: Upgrade to 5.5.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Illuminate component of Laravel Framework 5.7.x has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the destruct method of the PendingCommand class in PendingCommand.php.
Recommended action: Upgrade to 6.20.44 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.
Recommended action: Upgrade to 5.6.30; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17.
Recommended action: Upgrade to 5.8.17 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A security researcher has disclosed a possible XSS vulnerability in the Blade templating engine. Given the following two Blade templates: resources/views/parent.blade.php: resources/views/child.blade.php: And a route like the following: The broken HTML element may be clicked and the user is taken to another location in their browser due to XSS. This is due to the user being able to guess the parent placeholder SHA-1 hash by trying common names of sections. If the parent template contains an exploitable HTML structure an XSS vulnerability can be exposed. This vulnerability has been patched by determining the parent placeholder at runtime and using a random hash that is unique to each request.
Recommended action: Upgrade to 8.75.0, 7.30.6 or 6.20.42 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in Laravel before 6.18.35 and 7.x before 7.24.0. The $guarded property is mishandled in some situations involving requests with JSON column nesting expressions.
Recommended action: Upgrade to 7.24.0 or 6.18.35 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.