Description
Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| laravel | framework | >= 12.0.0, < 12.1.1, < 11.44.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | php-laravel-framework | 10.48.29+dfsg-1 | — |
| Debian 13 | php-laravel-framework | 10.48.29+dfsg-1 | — |
| Debian 12 | php-laravel-framework | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
joaovicdev/EXPLOIT-CVE-2025-27515 ★ 2 · Dec 30, 2025
PoC of CVE-2025-27515
-
Shanks2001/Progetto-sicurezza ★ 0 · Oct 19, 2026
Penetration test white-box su un’app Laravel: analisi Cyber Kill Chain, RCE via file upload bypass (CVE-2025-27515), exfiltration e remediation.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | laravel/framework | >= 12.0.0, < 12.1.1 | 12.1.1 | GHSA-78fx-h6xr-vch4 |
| Packagist | laravel/framework | >= 11.0.0, < 11.44.1 | 11.44.1 | GHSA-78fx-h6xr-vch4 |
| Packagist | laravel/framework | < 10.48.29 | 10.48.29 | GHSA-78fx-h6xr-vch4 |
Advisories 1
- WID-SEC-2025-0493 Laravel Framework: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Mar 5, 2025