Every CVE Search/ Get API key

CVE-2021-3129

Unauthenticated remote code execution in Ignition

9.8 CriticalIn KEVPublic exploitFix available

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

99.9%Up 92.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

Record
CVE-2021-3129
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated
2026-11-02
CVE List 9.8

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

Record
CVE-2021-3129
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
EUVDEUVD-2021-0599 9.8

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

Record
EUVD-2021-0599
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-4qwp-7c67-jmcc 9.8

Unauthenticated remote code execution in Ignition

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

Record
GHSA-4qwp-7c67-jmcc
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weakness
CWE-94
Updated
2026-11-02
CISA KEV No score

Laravel Ignition File Upload Vulnerability

Laravel Ignition contains a file upload vulnerability that allows unauthenticated remote attackers to execute malicious code due to insecure usage of file_get_contents() and file_put_contents().

Record
CVE-2021-3129
Updated
2026-11-02
OSV 9.8

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

Record
CVE-2021-3129
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-4qwp-7c67-jmcc 9.8

Unauthenticated remote code execution in Ignition

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

Record
GHSA-4qwp-7c67-jmcc
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weakness
CWE-94
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
facade/ignition
Packagist
 2.5.0 up to 2.5.2
2.5.2
facade/ignition
Packagist
 2.0.0 up to 2.4.2
2.4.2
facade/ignition
Packagist
 1.7.0 up to 1.16.14
1.16.14
facade/ignition
Packagist
 before 1.6.15
1.6.15
facade/ignition
Packagist
 2.5.0 up to 2.5.2, plus listed versions
2.5.1
2.5.2
facade/ignition
Packagist
 2.0.0 up to 2.4.2, plus listed versions
2.0.12.0.102.0.22.0.42.0.5
Show 17 moreShow less
2.0.62.0.72.0.82.0.92.1.02.2.02.3.02.3.12.3.22.3.32.3.42.3.52.3.62.3.72.3.82.4.02.4.1
2.4.2
facade/ignition
Packagist
 1.7.0 up to 1.16.14, plus listed versions
1.10.01.11.01.11.11.11.21.12.0
Show 18 moreShow less
1.12.11.13.01.13.11.14.01.15.01.16.01.16.11.16.21.16.31.16.41.7.11.8.01.8.11.8.21.8.41.9.01.9.11.9.2
1.16.14
facade/ignition
Packagist
 before 1.6.15, plus listed versions
1.0.01.0.11.0.21.0.31.0.4
Show 36 moreShow less
1.1.01.1.11.2.01.3.01.4.01.4.11.4.101.4.111.4.121.4.131.4.141.4.151.4.161.4.171.4.181.4.191.4.21.4.31.4.41.4.51.4.61.4.71.4.81.4.91.5.01.6.01.6.11.6.101.6.21.6.31.6.41.6.51.6.61.6.71.6.81.6.9
1.6.15

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubambionics/laravel-exploits2021-01-13
MetasploitUnauthenticated remote code execution in Ignition2021-01-13
Exploit-DBLaravel 8.4.2 debug mode - Remote code execution2021-01-14
PoC in GitHubSNCKER/CVE-2021-31292021-01-22
PoC in GitHubSecPros-Team/laravel-CVE-2021-3129-EXP2021-01-25
PoC in GitHubcrisprss/Laravel_CVE-2021-3129_EXP2021-01-27
PoC in GitHubnth347/CVE-2021-3129_exploit2021-01-27
PoC in GitHubFunPhishing/Laravel-8.4.2-rce-CVE-2021-31292021-02-14
PoC in GitHubzhzyker/CVE-2021-31292021-02-18
PoC in GitHubY0s9/CVE-2021-31292021-04-11
Show 18 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubidea-oss/laravel-CVE-2021-3129-EXP2021-07-22
PoC in GitHubknqyf263/CVE-2021-31292021-10-01
PoC in GitHubcuongtop4598/CVE-2021-3129-Script2022-04-08
PoC in GitHubjoshuavanderpoll/CVE-2021-31292022-04-16
PoC in GitHubshadowabi/Laravel-CVE-2021-31292022-06-04
PoC in GitHubhupe1980/CVE-2021-31292022-09-30
PoC in GitHub0nion1/CVE-2021-31292022-10-11
PoC in GitHubMadExploits/Laravel-debug-Checker2022-12-10
PoC in GitHubajisai-babu/CVE-2021-3129-exp2023-03-04
PoC in GitHubkeyuan15/CVE-2021-31292023-03-11
PoC in GitHubZoo1sondv/CVE-2021-31292023-05-01
PoC in GitHubmiko550/CVE-2021-31292023-07-26
PoC in GitHubwmasday/CVE-2021-31292023-07-27
PoC in GitHubbanyaksepuh/Mass-CVE-2021-3129-Scanner2023-10-22
PoC in GitHubAxianke/CVE-2021-31292024-01-15
PoC in GitHubcc3305/CVE-2021-31292024-05-19
PoC in GitHubpiperpwn/CVE-2021-3129-piperpwn2024-07-16
NucleiLaravel with Ignition <= v8.4.2 Debug Mode - Remote Code Execution

History

History
RecordedChangedSources
exploitation
exploits, exploits_more
exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-3129 is a critical vulnerability (CVSS 9.8) in Facade Ignition, published January 12, 2021. CISA lists it as known to be exploited, since September 18, 2023. EUVD reports exploitation since September 18, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.9%, the 99th percentile. Fixed in facade/ignition 2.5.2.

References

Show 4 moreShow less
This page doesn't list everything

The full exploit list has 8 more links.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open