Skip to content
OpenAdvisories
High · 8.9 Public exploit CVE-2026-48019 EUVD-2026-71787GHSA-5vg9-5847-vvmq

CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay

Published Sep 4, 2026 · Updated Sep 8, 2026 · Assigned by GitHub_M

Vendor: laravel Product: framework Package: laravel/framework Package: php-laravel-framework Ecosystem: Debian Ecosystem: Packagist

Description

Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patched in versions 12.60.0 and 13.10.0.

Affected products

VendorProductAffectedFixed
laravel framework >= 13.0.0, < 13.10.0, < 12.60.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 php-laravel-framework 13.31.0+dfsg-1 —
Debian 13 php-laravel-framework No fix yet —
Debian 12 php-laravel-framework No fix yet —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • derrickschoen/laravel-framework ★ 0 · Jun 14, 2026

    Fork of laravel/framework 10.50.2 with CVE-2026-48019 (CRLF injection in default email rule) backported into ValidatesAttributes::validateEmail. Tagged 10.51.0.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist laravel/framework >= 13.0.0, < 13.10.0 13.10.0 GHSA-5vg9-5847-vvmq
Packagist laravel/framework < 12.60.0 12.60.0 GHSA-5vg9-5847-vvmq

Advisories 1

References