{"id":"CVE-2017-16894","aliases":["CLSA-2026-1773017339","EUVD-2017-8065","GHSA-2v4r-7m2m-5chh","GHSA-7852-w36x-6mf6","GHSA-x7p5-p2c9-phvg"],"status":"published","title":"In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as...","description":"In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in src/Illuminate/Foundation/Console/KeyGenerateCommand.php, which uses file_put_contents without restricting the .env permissions. The .env filename is not used exclusively by Laravel framework.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.86916,"percentile":0.99748,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-1240","CWE-200"],"published":"2017-11-20T01:00:00Z","modified":"2026-10-24T10:30:38Z","exploits":[{"source":"metasploit","id":"exploit/unix/http/laravel_token_unserialize_exec","title":"PHP Laravel Framework token Unserialize Remote Command Execution","type":"exploit","platform":"Unix","date":"2018-08-07","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/unix/http/laravel_token_unserialize_exec"},{"source":"exploitdb","id":"EDB-47129","title":"PHP Laravel Framework 5.5.40 / 5.6.x \u003c 5.6.30 - token Unserialize Remote Command Execution (Metasploit)","type":"remote","platform":"linux","date":"2019-07-16","verified":true,"url":"https://www.exploit-db.com/exploits/47129"},{"source":"nuclei","id":"CVE-2017-16894","title":"Laravel \u003c5.5.21 - Information Disclosure","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-16894.yaml"}],"fixes":[{"ecosystem":"Packagist","package":"laravel/framework","fixed_in":["5.5.40","5.6.15"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.40"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.0"},{"fixed":"5.6.15"}]}]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.36"},{"fixed":"5.4.36-p2+tuxcare"}]}],"versions":["5.4.36","5.4.36-p1+tuxcare"],"bundled":8},{"source":"osv","ecosystem":"Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.40"}]}],"versions":["5.0.30","5.2.41","v4.0.0","v4.0.0-BETA2","v4.0.0-BETA3","v4.0.0-BETA4","v4.0.1","v4.0.10","v4.0.11","v4.0.2","v4.0.3","v4.0.4","v4.0.5","v4.0.6","v4.0.7","v4.0.8","v4.0.9","v4.1.0","v4.1.1","v4.1.10","v4.1.11","v4.1.12","v4.1.13","v4.1.14","v4.1.15","v4.1.16","v4.1.17","v4.1.18","v4.1.19","v4.1.2","v4.1.20","v4.1.21","v4.1.22","v4.1.23","v4.1.24","v4.1.25","v4.1.26","v4.1.27","v4.1.28","v4.1.29","v4.1.3","v4.1.30","v4.1.31","v4.1.4","v4.1.5","v4.1.6","v4.1.7","v4.1.8","v4.1.9","v4.2.0","v4.2.0-BETA1","v4.2.1","v4.2.10","v4.2.11","v4.2.12","v4.2.13","v4.2.14","v4.2.15","v4.2.16","v4.2.17","v4.2.18","v4.2.19","v4.2.2","v4.2.20","v4.2.21","v4.2.22","v4.2.3","v4.2.4","v4.2.5","v4.2.6","v4.2.7","v4.2.8","v4.2.9","v5.0.0","v5.0.1","v5.0.10","v5.0.11","v5.0.12","v5.0.13","v5.0.14","v5.0.15","v5.0.16","v5.0.17","v5.0.18","v5.0.19","v5.0.2","v5.0.20","v5.0.21","v5.0.22","v5.0.23","v5.0.24","v5.0.25","v5.0.26","v5.0.27","v5.0.28","v5.0.29","v5.0.3","v5.0.31","v5.0.32","v5.0.33","v5.0.34","v5.0.35","v5.0.4","v5.0.5","v5.0.6","v5.0.7","v5.0.8","v5.0.9","v5.1.0","v5.1.1","v5.1.10","v5.1.11","v5.1.12","v5.1.13","v5.1.14","v5.1.15","v5.1.16","v5.1.17","v5.1.18","v5.1.19","v5.1.2","v5.1.20","v5.1.21","v5.1.22","v5.1.23","v5.1.24","v5.1.25","v5.1.26","v5.1.27","v5.1.28","v5.1.29","v5.1.3","v5.1.30","v5.1.31","v5.1.32","v5.1.33","v5.1.34","v5.1.35","v5.1.36","v5.1.37","v5.1.38","v5.1.39","v5.1.4","v5.1.40","v5.1.41","v5.1.42","v5.1.43","v5.1.44","v5.1.45","v5.1.46","v5.1.5","v5.1.6","v5.1.7","v5.1.8","v5.1.9","v5.2.0","v5.2.0-beta1","v5.2.1","v5.2.10","v5.2.11","v5.2.12","v5.2.13","v5.2.14","v5.2.15","v5.2.16","v5.2.17","v5.2.18","v5.2.19","v5.2.2","v5.2.20","v5.2.21","v5.2.22","v5.2.23","v5.2.24","v5.2.25","v5.2.26","v5.2.27","v5.2.28","v5.2.29","v5.2.3","v5.2.30","v5.2.31","v5.2.32","v5.2.33","v5.2.34","v5.2.35","v5.2.36","v5.2.37","v5.2.38","v5.2.39","v5.2.4","v5.2.40","v5.2.42","v5.2.43","v5.2.44","v5.2.45","v5.2.5","v5.2.6","v5.2.7","v5.2.8","v5.2.9","v5.3.0","v5.3.0-RC1","v5.3.1","v5.3.10","v5.3.11","v5.3.12","v5.3.13","v5.3.14","v5.3.15","v5.3.16","v5.3.17","v5.3.18","v5.3.19","v5.3.2","v5.3.20","v5.3.21","v5.3.22","v5.3.23","v5.3.24","v5.3.25","v5.3.26","v5.3.27","v5.3.28","v5.3.29","v5.3.3","v5.3.30","v5.3.31","v5.3.4","v5.3.5","v5.3.6","v5.3.7","v5.3.8","v5.3.9","v5.4.0","v5.4.1","v5.4.10","v5.4.11","v5.4.12","v5.4.13","v5.4.14","v5.4.15","v5.4.16","v5.4.17","v5.4.18","v5.4.19","v5.4.2","v5.4.20","v5.4.21","v5.4.22","v5.4.23","v5.4.24","v5.4.25","v5.4.26","v5.4.27","v5.4.28","v5.4.29","v5.4.3","v5.4.30","v5.4.31","v5.4.32","v5.4.33","v5.4.34","v5.4.35","v5.4.36","v5.4.4","v5.4.5","v5.4.6","v5.4.7","v5.4.8","v5.4.9","v5.5.0","v5.5.1","v5.5.10","v5.5.11","v5.5.12","v5.5.13","v5.5.14","v5.5.15","v5.5.16","v5.5.17","v5.5.18","v5.5.19","v5.5.2","v5.5.20","v5.5.21","v5.5.22","v5.5.23","v5.5.24","v5.5.25","v5.5.26","v5.5.27","v5.5.28","v5.5.29","v5.5.3","v5.5.30","v5.5.31","v5.5.32","v5.5.33","v5.5.34","v5.5.35","v5.5.36","v5.5.37","v5.5.38","v5.5.39","v5.5.4","v5.5.5","v5.5.6","v5.5.7","v5.5.8","v5.5.9"]},{"source":"osv","ecosystem":"Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.0"},{"fixed":"5.6.15"}]}],"versions":["v5.6.0","v5.6.1","v5.6.10","v5.6.11","v5.6.12","v5.6.13","v5.6.14","v5.6.2","v5.6.3","v5.6.4","v5.6.5","v5.6.6","v5.6.7","v5.6.8","v5.6.9"]}],"products":[{"vendor":"laravel","product":"laravel"}],"references":[{"url":"https://twitter.com/finnwea/status/967709791442341888","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://whiteboyz.xyz/laravel-env-file-vuln.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","URL Repurposed","advisory"]},{"url":"http://packetstormsecurity.com/files/153641/PHP-Laravel-Framework-Token-Unserialize-Remote-Command-Execution.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16894"},{"url":"https://github.com/advisories/GHSA-2v4r-7m2m-5chh"},{"url":"https://github.com/laravel/framework/commit/28e53f23a76206fb130e9a54eb95aa3f010e79c9","tags":["web"]},{"url":"https://github.com/laravel/framework/commit/886d261df0854426b4662b7ed5db6a1c575a4279","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/2018-03-30-1.yaml","tags":["web"]},{"url":"https://medium.com/@taylorotwell/laravel-security-release-5-6-15-and-5-5-40-56f1257933a0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7852-w36x-6mf6"},{"url":"https://github.com/laravel/framework","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2017-16894","description":"In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in src/Illuminate/Foundation/Console/KeyGenerateCommand.php, which uses file_put_contents without restricting the .env permissions. The .env filename is not used exclusively by Laravel framework.","status":"published","published":"2017-11-20T01:00:00Z","modified":"2024-08-05T20:35:21.344Z","updated_at":"2026-11-02T14:33:21.453505Z"}],"euvd":[{"id":"EUVD-2017-8065","description":"In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in src/Illuminate/Foundation/Console/KeyGenerateCommand.php, which uses file_put_contents without restricting the .env permissions. The .env filename is not used exclusively by Laravel framework.","status":"published","published":"2017-11-20T01:00:00Z","modified":"2024-08-05T20:35:21Z","updated_at":"2026-11-03T02:23:11.095005Z"}],"ghsa":[{"id":"GHSA-2v4r-7m2m-5chh","title":"In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as...","description":"In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in src/Illuminate/Foundation/Console/KeyGenerateCommand.php, which uses file_put_contents without restricting the .env permissions. The .env filename is not used exclusively by Laravel framework.","status":"published","published":"2022-05-14T03:39:38Z","modified":"2023-02-02T05:08:17Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:52:42.475291Z"},{"id":"GHSA-7852-w36x-6mf6","title":"Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior","description":"The Laravel Encrypter component is susceptible to a vulnerability that may result in decryption failure, leading to an unexpected return of `false`. Exploiting this issue requires the attacker to manipulate the encrypted payload before decryption. When combined with weak type comparisons in the application's code, such as the example below:\n\n```\n\u003c?php\n\n$decyptedValue = decrypt($secret);\n\nif ($decryptedValue == '') {\n    // Code is run even though decrypted value is false...\n}\n```","status":"published","published":"2024-05-15T22:08:06Z","modified":"2024-05-15T22:08:07Z","cwes":["CWE-1240"],"updated_at":"2026-11-02T14:37:49.987036Z"}],"nvd":[{"id":"CVE-2017-16894","description":"In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in src/Illuminate/Foundation/Console/KeyGenerateCommand.php, which uses file_put_contents without restricting the .env permissions. The .env filename is not used exclusively by Laravel framework.","status":"published","published":"2017-11-20T01:29:00.227Z","modified":"2026-06-17T01:10:06.353Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:04:09.7374Z"}],"osv":[{"id":"CVE-2017-16894","description":"In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in src/Illuminate/Foundation/Console/KeyGenerateCommand.php, which uses file_put_contents without restricting the .env permissions. The .env filename is not used exclusively by Laravel framework.","status":"published","published":"2017-11-20T01:29:00.227Z","modified":"2026-10-24T10:30:38.353893764Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:04.853379Z"},{"id":"CLSA-2026-1773017339","title":"TuxCare security update for laravel/framework (10 CVEs)","description":"TuxCare rebuilt laravel/framework to address 10 CVEs. Fixed in 5.4.36-p2+tuxcare.","status":"published","published":"2026-08-04T14:52:34Z","modified":"2026-10-15T09:48:04.641650282Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"GHSA-7852-w36x-6mf6","title":"Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior","description":"The Laravel Encrypter component is susceptible to a vulnerability that may result in decryption failure, leading to an unexpected return of `false`. Exploiting this issue requires the attacker to manipulate the encrypted payload before decryption. When combined with weak type comparisons in the application's code, such as the example below:\n\n```\n\u003c?php\n\n$decyptedValue = decrypt($secret);\n\nif ($decryptedValue == '') {\n    // Code is run even though decrypted value is false...\n}\n```","status":"published","published":"2024-05-15T22:08:06Z","modified":"2024-11-29T05:40:57.344982Z","cwes":["CWE-1240"],"updated_at":"2026-11-02T15:46:40.657155Z"}]}}