Every CVE Search/ Get API key

CVE-2021-43617

Withdrawn: Laravel Framework does not sufficiently block the upload of executable PHP content.

9.8 CriticalPublic exploitFix available

Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

20.0%Up 18.7 points since Nov 15, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.

Record
CVE-2021-43617
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-434
Updated
2026-11-02
CVE List No score

Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.

Record
CVE-2021-43617
Updated
2026-11-02
EUVDEUVD-2021-2284 No score

Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.

Record
EUVD-2021-2284
Updated
2026-11-03
GitHub AdvisoriesGHSA-qm5c-m76r-2hfr 9.9

Laravel RCE vulnerability in "cookie" session driver

Applications using the "cookie" session driver that were also exposing an encryption oracle via their application were vulnerable to remote code execution. An encryption oracle is a mechanism where arbitrary user input is encrypted and the encrypted string is later displayed or exposed to the user. This combination of scenarios lets the user generate valid Laravel signed encryption strings for any plain-text string, thus allowing them to craft Laravel session payloads when an application is using the "cookie" driver.

Record
GHSA-qm5c-m76r-2hfr
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-364w-9g92-3grq No score

Withdrawn: Laravel Framework does not sufficiently block the upload of executable PHP content.

Withdrawn

This advisory has been withdrawn after the maintainers of Laravel noted this issue is not a security vulnerability with Laravel itself, but rather a userland issue.

Original CVE based description

Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. In some use cases, this may be related to file-type validation for image upload (e.g., differences between getClientOriginalExtension and other approaches).

Record
GHSA-364w-9g92-3grq
Weakness
CWE-434
Updated
2026-11-02
GitHub AdvisoriesGHSA-4mg9-vhxq-vm7j No score

SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database

Impact

Those using SQL Server with Laravel and allowing user input to be passed directly to the limit and offset functions are vulnerable to SQL injection. Other database drivers such as MySQL and Postgres are not affected by this vulnerability.

Patches

This problem has been patched on Laravel versions 6.20.26, 7.30.5, and 8.40.0.

Workarounds

You may workaround this vulnerability by ensuring that only integers are passed to the limit and offset functions, as well as the skip and take functions.

Record
GHSA-4mg9-vhxq-vm7j
Weakness
CWE-89
Updated
2026-11-02
Show 12 moreShow less
OSV 9.8

Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.

Record
CVE-2021-43617
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-43617 9.8

Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.

Record
DEBIAN-CVE-2021-43617
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-qm5c-m76r-2hfr 9.9

Laravel RCE vulnerability in "cookie" session driver

Applications using the "cookie" session driver that were also exposing an encryption oracle via their application were vulnerable to remote code execution. An encryption oracle is a mechanism where arbitrary user input is encrypted and the encrypted string is later displayed or exposed to the user. This combination of scenarios lets the user generate valid Laravel signed encryption strings for any plain-text string, thus allowing them to craft Laravel session payloads when an application is using the "cookie" driver.

Record
GHSA-qm5c-m76r-2hfr
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVCLSA-2025-1765932544 No score

TuxCare security update for laravel/framework (5 CVEs)

TuxCare rebuilt laravel/framework to address 5 CVEs. Fixed in 5.8.38-p1+tuxcare.

Record
CLSA-2025-1765932544
Updated
2026-11-02
OSVCLSA-2026-1772239984 No score

TuxCare security update for illuminate/database (1 CVE)

TuxCare rebuilt illuminate/database to address 1 CVE. Fixed in 5.4.36-p1+tuxcare.

Record
CLSA-2026-1772239984
Updated
2026-11-02
OSVCLSA-2026-1773103742 No score

TuxCare security update for laravel/framework (9 CVEs)

TuxCare rebuilt laravel/framework to address 9 CVEs. Fixed in 5.6.40-p1+tuxcare.

Record
CLSA-2026-1773103742
Updated
2026-11-02
OSVCLSA-2026-1773103743 No score

TuxCare security update for laravel/framework (9 CVEs)

TuxCare rebuilt laravel/framework to address 9 CVEs. Fixed in 5.7.29-p1+tuxcare.

Record
CLSA-2026-1773103743
Updated
2026-11-02
OSVCLSA-2026-1773362940 No score

TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 5.4.36-p3+tuxcare.

Record
CLSA-2026-1773362940
Updated
2026-11-02
OSVCLSA-2026-1777596011 No score

TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 5.4.36-p4+tuxcare.

Record
CLSA-2026-1777596011
Updated
2026-11-02
OSVCLSA-2026-1777596013 No score

TuxCare security update for laravel/framework (2 CVEs)

TuxCare rebuilt laravel/framework to address 2 CVEs. Fixed in 5.5.50-p2+tuxcare.

Record
CLSA-2026-1777596013
Updated
2026-11-02
OSVGHSA-364w-9g92-3grq No score

Withdrawn: Laravel Framework does not sufficiently block the upload of executable PHP content.

Withdrawn

This advisory has been withdrawn after the maintainers of Laravel noted this issue is not a security vulnerability with Laravel itself, but rather a userland issue.

Original CVE based description

Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. In some use cases, this may be related to file-type validation for image upload (e.g., differences between getClientOriginalExtension and other approaches).

Record
GHSA-364w-9g92-3grq
Weakness
CWE-434
Updated
2026-11-02
OSVGHSA-4mg9-vhxq-vm7j No score

SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database

Impact

Those using SQL Server with Laravel and allowing user input to be passed directly to the limit and offset functions are vulnerable to SQL injection. Other database drivers such as MySQL and Postgres are not affected by this vulnerability.

Patches

This problem has been patched on Laravel versions 6.20.26, 7.30.5, and 8.40.0.

Workarounds

You may workaround this vulnerability by ensuring that only integers are passed to the limit and offset functions, as well as the skip and take functions.

Record
GHSA-4mg9-vhxq-vm7j
Weakness
CWE-89
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
laravel/framework
Packagist
 8.0.0 up to 8.40.0
8.40.0
laravel/framework
Packagist
 before 6.20.26
6.20.26
illuminate/database
Packagist
 8.0.0 up to 8.40.0
8.40.0
illuminate/database
Packagist
 before 6.20.26
6.20.26
laravel/framework
Packagist
 4.1.0 up to 6.18.31
6.18.31
laravel/framework
Packagist
 7.0.0 up to 7.22.4
7.22.4
laravel/framework
TuxCare:Packagist
 5.8.38 up to 5.8.38-p1+tuxcare
5.8.38-p1+tuxcare
illuminate/database
TuxCare:Packagist
 5.4.36 up to 5.4.36-p1+tuxcare
5.4.36-p1+tuxcare
laravel/framework
TuxCare:Packagist
 5.6.40 up to 5.6.40-p1+tuxcare
5.6.40-p1+tuxcare
laravel/framework
TuxCare:Packagist
 5.7.29 up to 5.7.29-p1+tuxcare
5.7.29-p1+tuxcare
Show 12 moreShow less
Affected packages
PackageAffectedFixed
laravel/framework
TuxCare:Packagist
 5.4.36 up to 5.4.36-p3+tuxcare, plus listed versions
5.4.36-p1+tuxcare5.4.36-p2+tuxcare
5.4.36-p3+tuxcare
laravel/framework
TuxCare:Packagist
 5.4.36 up to 5.4.36-p4+tuxcare, plus listed versions
5.4.36-p1+tuxcare5.4.36-p2+tuxcare5.4.36-p3+tuxcare
5.4.36-p4+tuxcare
laravel/framework
TuxCare:Packagist
 5.5.50 up to 5.5.50-p2+tuxcare, plus listed versions
5.5.50-p1+tuxcare
5.5.50-p2+tuxcare
php-laravel-framework
Debian:12
 before 6.20.14+dfsg-3
6.20.14+dfsg-3
php-laravel-framework
Debian:13
 before 6.20.14+dfsg-3
6.20.14+dfsg-3
php-laravel-framework
Debian:14
 before 6.20.14+dfsg-3
6.20.14+dfsg-3
laravel/framework
Packagist
 8.0.0 up to 8.40.0, plus listed versions
v8.0.0v8.0.1v8.0.2v8.0.3v8.0.4
Show 45 moreShow less
v8.1.0v8.10.0v8.11.0v8.11.1v8.11.2v8.12.0v8.12.1v8.12.2v8.12.3v8.13.0v8.14.0v8.15.0v8.16.0v8.16.1v8.17.0v8.17.1v8.17.2v8.18.0v8.18.1v8.19.0v8.2.0v8.20.0v8.20.1v8.21.0v8.22.0v8.22.1v8.23.0v8.23.1v8.24.0v8.25.0v8.26.0v8.26.1v8.27.0v8.28.0v8.28.1v8.29.0v8.3.0v8.30.0v8.30.1v8.31.0v8.32.0v8.32.1v8.33.0v8.33.1v8.34.0
8.40.0
laravel/framework
Packagist
 before 6.20.26, plus listed versions
5.0.305.2.41v4.0.0v4.0.0-BETA2v4.0.0-BETA3
Show 45 moreShow less
v4.0.0-BETA4v4.0.1v4.0.10v4.0.11v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.1v4.1.10v4.1.11v4.1.12v4.1.13v4.1.14v4.1.15v4.1.16v4.1.17v4.1.18v4.1.19v4.1.2v4.1.20v4.1.21v4.1.22v4.1.23v4.1.24v4.1.25v4.1.26v4.1.27v4.1.28v4.1.29v4.1.3v4.1.30v4.1.31v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9v4.2.0
6.20.26
illuminate/database
Packagist
 8.0.0 up to 8.40.0, plus listed versions
v8.0.0v8.0.1v8.0.2v8.0.3v8.0.4
Show 45 moreShow less
v8.1.0v8.10.0v8.11.0v8.11.1v8.11.2v8.12.0v8.12.1v8.12.2v8.12.3v8.13.0v8.14.0v8.15.0v8.16.0v8.16.1v8.17.0v8.17.2v8.18.0v8.18.1v8.19.0v8.2.0v8.20.0v8.20.1v8.21.0v8.22.0v8.22.1v8.23.1v8.24.0v8.25.0v8.26.0v8.26.1v8.27.0v8.28.0v8.28.1v8.29.0v8.3.0v8.30.0v8.30.1v8.31.0v8.32.0v8.32.1v8.33.0v8.33.1v8.34.0v8.35.0v8.35.1
8.40.0
illuminate/database
Packagist
 before 6.20.26, plus listed versions
5.7.175.7.185.7.19v1.0.0v1.1.0
Show 45 moreShow less
v1.1.1v4.0.0v4.0.0-BETA2v4.0.0-BETA3v4.0.0-BETA4v4.0.1v4.0.10v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.1v4.1.10v4.1.11v4.1.12v4.1.13v4.1.14v4.1.15v4.1.16v4.1.17v4.1.18v4.1.19v4.1.2v4.1.20v4.1.21v4.1.22v4.1.23v4.1.24v4.1.25v4.1.26v4.1.27v4.1.28v4.1.29v4.1.3v4.1.30v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8
6.20.26
laravel/framework
Packagist
 4.1.0 up to 6.18.31, plus listed versions
5.0.305.2.41v4.1.0v4.1.1v4.1.10
Show 45 moreShow less
v4.1.11v4.1.12v4.1.13v4.1.14v4.1.15v4.1.16v4.1.17v4.1.18v4.1.19v4.1.2v4.1.20v4.1.21v4.1.22v4.1.23v4.1.24v4.1.25v4.1.26v4.1.27v4.1.28v4.1.29v4.1.3v4.1.30v4.1.31v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9v4.2.0v4.2.0-BETA1v4.2.1v4.2.10v4.2.11v4.2.12v4.2.13v4.2.14v4.2.15v4.2.16v4.2.17v4.2.18v4.2.19v4.2.2v4.2.20v4.2.21
6.18.31
laravel/framework
Packagist
 7.0.0 up to 7.22.4, plus listed versions
v7.0.0v7.0.1v7.0.2v7.0.3v7.0.4
Show 45 moreShow less
v7.0.5v7.0.6v7.0.7v7.0.8v7.1.0v7.1.1v7.1.2v7.1.3v7.10.0v7.10.1v7.10.2v7.10.3v7.11.0v7.12.0v7.13.0v7.14.0v7.14.1v7.15.0v7.16.0v7.16.1v7.17.0v7.17.1v7.17.2v7.18.0v7.19.0v7.19.1v7.2.0v7.2.1v7.2.2v7.20.0v7.21.0v7.22.0v7.22.1v7.22.2v7.22.3v7.3.0v7.4.0v7.5.0v7.5.1v7.5.2v7.6.0v7.6.1v7.6.2v7.7.0v7.7.1
7.22.4

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBPHP Laravel 8.70.1 - Cross Site Scripting (XSS) to Cross Site Request Forgery (CSRF)2021-11-15
PoC in GitHubSybelle03/CVE-2021-436172023-06-08
PoC in GitHubaweiiy/CVE-2021-436172022-08-03
PoC in GitHubkombat1/CVE-2021-436172021-11-19

History

History
RecordedChangedSources
affected
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-43617 is a critical vulnerability (CVSS 9.8) in Laravel Framework, published April 29, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 20.0%, the 97th percentile. Fixed in laravel/framework 8.40.0.

References

Show 9 moreShow less
This page doesn't list everything

Left out here: 1,208 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open