Skip to content
OpenAdvisories

Package · Debian

php-laravel-framework

10 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 9.2
    CVE-2026-114509 Public exploit

    Laravel TokenGuard authentication bypass through non-string API credentials

    Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can matc…

    laravel framework laravel/framework php-laravel-framework Debian Packagist
  • High 8.9
    CVE-2026-48019 Public exploit

    CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay

    Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticat…

    laravel framework laravel/framework php-laravel-framework Debian Packagist
  • Medium 6.9
    CVE-2025-27515 Public exploit

    Laravel has a File Validation Bypass

    Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.

    laravel framework laravel/framework php-laravel-framework Debian Packagist
  • High 8.7
    CVE-2024-52301 Public exploit EPSS 45%

    Laravel allows environment manipulation via query string

    Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerabi…

    laravel framework laravel/framework php-laravel-framework Debian Packagist
  • Unscored —
    CVE-2021-43617 Public exploit EPSS 20%

    Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Va…

    php-laravel-framework Debian