Description
The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of route parameters in the debug-mode error page.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Laravel Holdings | Laravel Framework | 11.9.0 – ≤ 11.35.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | laravel/framework | >= 11.9.0, < 11.36.0 | 11.36.0 | GHSA-83wp-f5c3-hqqr |
Advisories 1
- WID-SEC-2025-0520 Laravel Framework: Mehrere Schwachstellen ermöglichen Cross-Site Scripting BSI CERT-Bund (WID) · Mar 10, 2025