Every CVE Search/ Get API key

CVE-2017-16894

In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as...

7.5 HighPublic exploitFix available

In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in src/Illuminate/Foundation/Console/KeyGenerateCommand.php, which uses file_put_contents without restricting the .env permissions. The .env filename is not used exclusively by Laravel framework.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

86.9%Up 61.0 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in src/Illuminate/Foundation/Console/KeyGenerateCommand.php, which uses file_put_contents without restricting the .env permissions. The .env filename is not used exclusively by Laravel framework.

Record
CVE-2017-16894
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
CVE List No score

In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in src/Illuminate/Foundation/Console/KeyGenerateCommand.php, which uses file_put_contents without restricting the .env permissions. The .env filename is not used exclusively by Laravel framework.

Record
CVE-2017-16894
Updated
2026-11-02
EUVDEUVD-2017-8065 No score

In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in src/Illuminate/Foundation/Console/KeyGenerateCommand.php, which uses file_put_contents without restricting the .env permissions. The .env filename is not used exclusively by Laravel framework.

Record
EUVD-2017-8065
Updated
2026-11-03
GitHub AdvisoriesGHSA-2v4r-7m2m-5chh 7.5

In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as...

In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in src/Illuminate/Foundation/Console/KeyGenerateCommand.php, which uses file_put_contents without restricting the .env permissions. The .env filename is not used exclusively by Laravel framework.

Record
GHSA-2v4r-7m2m-5chh
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
GitHub AdvisoriesGHSA-7852-w36x-6mf6 No score

Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior

The Laravel Encrypter component is susceptible to a vulnerability that may result in decryption failure, leading to an unexpected return of false. Exploiting this issue requires the attacker to manipulate the encrypted payload before decryption. When combined with weak type comparisons in the application's code, such as the example below:

<?php

$decyptedValue = decrypt($secret);

if ($decryptedValue == '') {
    // Code is run even though decrypted value is false...
}
Record
GHSA-7852-w36x-6mf6
Weakness
CWE-1240
Updated
2026-11-02
OSV 7.5

In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in src/Illuminate/Foundation/Console/KeyGenerateCommand.php, which uses file_put_contents without restricting the .env permissions. The .env filename is not used exclusively by Laravel framework.

Record
CVE-2017-16894
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVCLSA-2026-1773017339 No score

TuxCare security update for laravel/framework (10 CVEs)

TuxCare rebuilt laravel/framework to address 10 CVEs. Fixed in 5.4.36-p2+tuxcare.

Record
CLSA-2026-1773017339
Updated
2026-11-02
OSVGHSA-7852-w36x-6mf6 No score

Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior

The Laravel Encrypter component is susceptible to a vulnerability that may result in decryption failure, leading to an unexpected return of false. Exploiting this issue requires the attacker to manipulate the encrypted payload before decryption. When combined with weak type comparisons in the application's code, such as the example below:

<?php

$decyptedValue = decrypt($secret);

if ($decryptedValue == '') {
    // Code is run even though decrypted value is false...
}
Record
GHSA-7852-w36x-6mf6
Weakness
CWE-1240
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
laravel/framework
Packagist
 before 5.5.40
5.5.40
laravel/framework
Packagist
 5.6.0 up to 5.6.15
5.6.15
laravel/framework
TuxCare:Packagist
From an advisory covering 8 CVEs
 5.4.36 up to 5.4.36-p2+tuxcare, plus listed versions
5.4.36-p1+tuxcare
5.4.36-p2+tuxcare
laravel/framework
Packagist
 before 5.5.40, plus listed versions
5.0.305.2.41v4.0.0v4.0.0-BETA2v4.0.0-BETA3
Show 45 moreShow less
v4.0.0-BETA4v4.0.1v4.0.10v4.0.11v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.1v4.1.10v4.1.11v4.1.12v4.1.13v4.1.14v4.1.15v4.1.16v4.1.17v4.1.18v4.1.19v4.1.2v4.1.20v4.1.21v4.1.22v4.1.23v4.1.24v4.1.25v4.1.26v4.1.27v4.1.28v4.1.29v4.1.3v4.1.30v4.1.31v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9v4.2.0
5.5.40
laravel/framework
Packagist
 5.6.0 up to 5.6.15, plus listed versions
v5.6.0v5.6.1v5.6.10v5.6.11v5.6.12
Show 10 moreShow less
v5.6.13v5.6.14v5.6.2v5.6.3v5.6.4v5.6.5v5.6.6v5.6.7v5.6.8v5.6.9
5.6.15

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitPHP Laravel Framework token Unserialize Remote Command Execution2018-08-07
Exploit-DBPHP Laravel Framework 5.5.40 / 5.6.x < 5.6.30 - token Unserialize Remote Command Execution (Metasploit)2019-07-16
NucleiLaravel <5.5.21 - Information Disclosure

History

History
RecordedChangedSources
affected, exploits, facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, Metasploit, Nuclei, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-16894 is a high vulnerability (CVSS 7.5) in Laravel, published November 20, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 86.9%, the 99th percentile. Fixed in laravel/framework 5.5.40.

References

Show 5 moreShow less
This page doesn't list everything

Left out here: 261 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open