CVE-2019-9081
Laravel Framework Deserialization Vulnerability
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
What each source reports
GitHub Advisories Score usedGHSA-pfg4-p438-p874
Laravel Framework Deserialization Vulnerability
The Illuminate component of Laravel Framework 5.7.x has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the PendingCommand class in PendingCommand.php.
- Record
GHSA-pfg4-p438-p874- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
CVE List No score
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
- Record
CVE-2019-9081- Updated
- 2026-11-02
EUVDEUVD-2022-4751 No score
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
- Record
EUVD-2022-4751- Updated
- 2026-11-03
NVD No score
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
- Record
CVE-2019-9081- Updated
- 2026-11-02
OSVGHSA-pfg4-p438-p874
Laravel Framework Deserialization Vulnerability
The Illuminate component of Laravel Framework 5.7.x has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the PendingCommand class in PendingCommand.php.
- Record
GHSA-pfg4-p438-p874- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSVCLSA-2026-1793789612 No score
TuxCare security update for laravel/framework (1 CVE)
TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 11.44.0-p5+tuxcare.
- Record
CLSA-2026-1793789612- Updated
- 2026-11-04
Affected packages
| Package | Affected | Fixed |
|---|---|---|
laravel/frameworkPackagist |
5.7.0 up to 6.20.44 | 6.20.44 |
laravel/frameworkTuxCare:Packagist |
11.44.0 up to 11.44.0-p5+tuxcare, plus listed versions 11.44.0-p1+tuxcare11.44.0-p2+tuxcare11.44.0-p3+tuxcare11.44.0-p4+tuxcare |
11.44.0-p5+tuxcare |
laravel/frameworkPackagist |
5.7.0 up to 6.20.44, plus listed versions v5.7.0v5.7.1v5.7.10v5.7.11v5.7.12 Show 45 moreShow lessv5.7.13v5.7.14v5.7.15v5.7.16v5.7.17v5.7.18v5.7.19v5.7.2v5.7.20v5.7.21v5.7.22v5.7.23v5.7.24v5.7.25v5.7.26v5.7.27v5.7.28v5.7.29v5.7.3v5.7.4v5.7.5v5.7.6v5.7.7v5.7.8v5.7.9v5.8.0v5.8.1v5.8.10v5.8.11v5.8.12v5.8.13v5.8.14v5.8.15v5.8.16v5.8.17v5.8.18v5.8.19v5.8.2v5.8.20v5.8.21v5.8.22v5.8.23v5.8.24v5.8.25v5.8.26 |
6.20.44 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | nth347/CVE-2019-9081_PoC | 2021-05-17 |
| PoC in GitHub | scopion/cve-2019-9081 | 2021-10-29 |
| PoC in GitHub | qafdevsec/CVE-2019-9081_PoC | 2023-04-25 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, exploits, facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-9081 has been rejected by its source and should not be treated as a live vulnerability, published February 24, 2019. Public exploit code exists. Fixed in laravel/framework 6.20.44.
References
nvd.nist.gov/vuln/detail/CVE-2019-9081
github.com/Laworigin/Laworigin.github.io/blob/master/2019/02/21/laravelv5-7%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96rce/index.html
laworigin.github.io/2019/02/21/laravelv5-7%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96rce
Left out here: 140 versions. The JSON record has them.