CVE-2024-29291
An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database...
An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/logs/laravel.log. NOTE: this is disputed by multiple third parties because the owner of a Laravel Framework installation can choose to have debugging logs, but needs to set the access control appropriately for the type of data that may be logged.
Exploit likelihood
What each source reports
CVE List No score
An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/logs/laravel.log. NOTE: this is disputed by multiple third parties because the owner of a Laravel Framework installation can choose to have debugging logs, but needs to set the access control appropriately for the type of data that may be logged.
- Record
CVE-2024-29291- Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2024-26303 No score
An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/logs/laravel.log. NOTE: this is disputed by multiple third parties because the owner of a Laravel Framework installation can choose to have debugging logs, but needs to set the access control appropriately for the type of data that may be logged.
- Record
EUVD-2024-26303- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g8vg-q9j5-3vf5 No score
An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database...
An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/logs/laravel.log.
- Record
GHSA-g8vg-q9j5-3vf5- Weakness
- CWE-200
- Updated
- 2026-11-02
NVD No score
An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/logs/laravel.log. NOTE: this is disputed by multiple third parties because the owner of a Laravel Framework installation can choose to have debugging logs, but needs to set the access control appropriately for the type of data that may be logged.
- Record
CVE-2024-29291- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Laravel Framework 11 - Credential Leakage | 2024-04-21 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-29291 is a vulnerability with no CVSS score yet in Laravel Framework, published April 16, 2024. Its validity is disputed. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.34%, the 71st percentile.