GHSA-3wgq-h4fr-cwg5

laravel-crud-wizard-free has File Validation Bypass

6.9 MediumFix available

GHSA-3wgq-h4fr-cwg5 is a medium vulnerability (CVSS 6.9) in macropay-solutions/laravel-crud-wizard-free, published March 12, 2025. No source lists public exploit code. Fixed in macropay-solutions/laravel-crud-wizard-free 3.4.17.

What does this mean?

Severity: 6.9 MediumCVSS 4.0, GitHub Advisories
Exploit chance: UnscoredNo EPSS score yet
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 3.4.17macropay-solutions/laravel-crud-wizard-free

Description

Impact

Medium

Patches

Version 3.4.17 fixes illuminate/validation v 8.0.0 to 11.44.0

Workarounds

Register \MacropaySolutions\LaravelCrudWizard\Providers\ValidationServiceProvider instead of Illuminate\Validation\ValidationServiceProvider::class if you are using illuminate/validation < 11.44.1

References

https://github.com/laravel/framework/security/advisories/GHSA-78fx-h6xr-vch4

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Affected packages

Affected packages
Package	Affected	Fixed
`macropay-solutions/laravel-crud-wizard-free` Packagist	before 3.4.17	3.4.17

What each source reports

GitHub Advisories Score used6.9

laravel-crud-wizard-free has File Validation Bypass

Impact

Medium

Patches

Version 3.4.17 fixes illuminate/validation v 8.0.0 to 11.44.0

Workarounds

Register \MacropaySolutions\LaravelCrudWizard\Providers\ValidationServiceProvider instead of Illuminate\Validation\ValidationServiceProvider::class if you are using illuminate/validation < 11.44.1

References

https://github.com/laravel/framework/security/advisories/GHSA-78fx-h6xr-vch4

Record: GHSA-3wgq-h4fr-cwg5
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-155
Updated: 2026-11-02

OSV6.9

laravel-crud-wizard-free has File Validation Bypass

Impact

Medium

Patches

Version 3.4.17 fixes illuminate/validation v 8.0.0 to 11.44.0

Workarounds

Register \MacropaySolutions\LaravelCrudWizard\Providers\ValidationServiceProvider instead of Illuminate\Validation\ValidationServiceProvider::class if you are using illuminate/validation < 11.44.1

References

https://github.com/laravel/framework/security/advisories/GHSA-78fx-h6xr-vch4

Record: GHSA-3wgq-h4fr-cwg5
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-155
Updated: 2026-11-02

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	GitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.