{"id":"CVE-2018-15133","aliases":["CLSA-2026-1773017339","EUVD-2022-5039","GHSA-7852-w36x-6mf6","GHSA-qvqm-h22r-4cp9","GHSA-x7p5-p2c9-phvg"],"status":"published","title":"Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior","description":"In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.7657,"percentile":0.99545,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-1240","CWE-502"],"published":"2018-08-09T19:00:00Z","modified":"2026-10-24T10:30:24Z","kev":{"date_added":"2024-01-16","due_date":"2024-02-06","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2024-01-16"},{"source":"kev","since":"2024-01-16"}],"exploits":[{"source":"metasploit","id":"exploit/unix/http/laravel_token_unserialize_exec","title":"PHP Laravel Framework token Unserialize Remote Command Execution","type":"exploit","platform":"Unix","date":"2018-08-07","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/unix/http/laravel_token_unserialize_exec"},{"source":"pocgithub","id":"kozmic/laravel-poc-CVE-2018-15133","title":"kozmic/laravel-poc-CVE-2018-15133","date":"2018-08-14","url":"https://github.com/kozmic/laravel-poc-CVE-2018-15133"},{"source":"exploitdb","id":"EDB-47129","title":"PHP Laravel Framework 5.5.40 / 5.6.x \u003c 5.6.30 - token Unserialize Remote Command Execution (Metasploit)","type":"remote","platform":"linux","date":"2019-07-16","verified":true,"url":"https://www.exploit-db.com/exploits/47129"},{"source":"pocgithub","id":"Bilelxdz/Laravel-CVE-2018-15133","title":"Bilelxdz/Laravel-CVE-2018-15133","date":"2020-02-25","url":"https://github.com/Bilelxdz/Laravel-CVE-2018-15133"},{"source":"pocgithub","id":"Prabesh01/Laravel-PHP-Unit-RCE-Auto-shell-uploader","title":"Prabesh01/Laravel-PHP-Unit-RCE-Auto-shell-uploader","date":"2020-04-05","url":"https://github.com/Prabesh01/Laravel-PHP-Unit-RCE-Auto-shell-uploader"},{"source":"pocgithub","id":"bukitbarisan/laravel-rce-cve-2018-15133","title":"bukitbarisan/laravel-rce-cve-2018-15133","date":"2020-04-27","url":"https://github.com/bukitbarisan/laravel-rce-cve-2018-15133"},{"source":"pocgithub","id":"AlienX2001/better-poc-for-CVE-2018-15133","title":"AlienX2001/better-poc-for-CVE-2018-15133","date":"2020-11-09","url":"https://github.com/AlienX2001/better-poc-for-CVE-2018-15133"},{"source":"pocgithub","id":"aljavier/exploit_laravel_cve-2018-15133","title":"aljavier/exploit_laravel_cve-2018-15133","date":"2020-11-13","url":"https://github.com/aljavier/exploit_laravel_cve-2018-15133"},{"source":"pocgithub","id":"pwnedshell/Larascript","title":"pwnedshell/Larascript","date":"2020-12-21","url":"https://github.com/pwnedshell/Larascript"},{"source":"pocgithub","id":"AzhariKun/CVE-2018-15133","title":"AzhariKun/CVE-2018-15133","date":"2021-01-03","url":"https://github.com/AzhariKun/CVE-2018-15133"},{"source":"pocgithub","id":"NatteeSetobol/CVE-2018-15133-Lavel-Expliot","title":"NatteeSetobol/CVE-2018-15133-Lavel-Expliot","date":"2021-12-28","url":"https://github.com/NatteeSetobol/CVE-2018-15133-Lavel-Expliot"},{"source":"pocgithub","id":"0xSalle/cve-2018-15133","title":"0xSalle/cve-2018-15133","date":"2023-05-10","url":"https://github.com/0xSalle/cve-2018-15133"},{"source":"pocgithub","id":"Cr4zyD14m0nd137/Lab-for-cve-2018-15133","title":"Cr4zyD14m0nd137/Lab-for-cve-2018-15133","date":"2023-05-10","url":"https://github.com/Cr4zyD14m0nd137/Lab-for-cve-2018-15133"},{"source":"pocgithub","id":"yeahhbean/Laravel-CVE-2018-15133","title":"yeahhbean/Laravel-CVE-2018-15133","date":"2025-04-27","url":"https://github.com/yeahhbean/Laravel-CVE-2018-15133"},{"source":"pocgithub","id":"Loaxert/CVE-2018-15133-PoC","title":"Loaxert/CVE-2018-15133-PoC","date":"2025-11-19","url":"https://github.com/Loaxert/CVE-2018-15133-PoC"},{"source":"pocgithub","id":"flame-11/CVE-2018-15133-laravel-framework","title":"flame-11/CVE-2018-15133-laravel-framework","date":"2025-12-29","url":"https://github.com/flame-11/CVE-2018-15133-laravel-framework"}],"fixes":[{"ecosystem":"Packagist","package":"laravel/framework","fixed_in":["5.5.40","5.6.15","5.6.30"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.40"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.0"},{"fixed":"5.6.15"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.5.40"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.0"},{"last_affected":"5.6.29"},{"fixed":"5.6.30"}]}]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.36"},{"fixed":"5.4.36-p2+tuxcare"}]}],"versions":["5.4.36","5.4.36-p1+tuxcare"],"bundled":8},{"source":"osv","ecosystem":"Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.40"}]}],"versions":["5.0.30","5.2.41","v4.0.0","v4.0.0-BETA2","v4.0.0-BETA3","v4.0.0-BETA4","v4.0.1","v4.0.10","v4.0.11","v4.0.2","v4.0.3","v4.0.4","v4.0.5","v4.0.6","v4.0.7","v4.0.8","v4.0.9","v4.1.0","v4.1.1","v4.1.10","v4.1.11","v4.1.12","v4.1.13","v4.1.14","v4.1.15","v4.1.16","v4.1.17","v4.1.18","v4.1.19","v4.1.2","v4.1.20","v4.1.21","v4.1.22","v4.1.23","v4.1.24","v4.1.25","v4.1.26","v4.1.27","v4.1.28","v4.1.29","v4.1.3","v4.1.30","v4.1.31","v4.1.4","v4.1.5","v4.1.6","v4.1.7","v4.1.8","v4.1.9","v4.2.0","v4.2.0-BETA1","v4.2.1","v4.2.10","v4.2.11","v4.2.12","v4.2.13","v4.2.14","v4.2.15","v4.2.16","v4.2.17","v4.2.18","v4.2.19","v4.2.2","v4.2.20","v4.2.21","v4.2.22","v4.2.3","v4.2.4","v4.2.5","v4.2.6","v4.2.7","v4.2.8","v4.2.9","v5.0.0","v5.0.1","v5.0.10","v5.0.11","v5.0.12","v5.0.13","v5.0.14","v5.0.15","v5.0.16","v5.0.17","v5.0.18","v5.0.19","v5.0.2","v5.0.20","v5.0.21","v5.0.22","v5.0.23","v5.0.24","v5.0.25","v5.0.26","v5.0.27","v5.0.28","v5.0.29","v5.0.3","v5.0.31","v5.0.32","v5.0.33","v5.0.34","v5.0.35","v5.0.4","v5.0.5","v5.0.6","v5.0.7","v5.0.8","v5.0.9","v5.1.0","v5.1.1","v5.1.10","v5.1.11","v5.1.12","v5.1.13","v5.1.14","v5.1.15","v5.1.16","v5.1.17","v5.1.18","v5.1.19","v5.1.2","v5.1.20","v5.1.21","v5.1.22","v5.1.23","v5.1.24","v5.1.25","v5.1.26","v5.1.27","v5.1.28","v5.1.29","v5.1.3","v5.1.30","v5.1.31","v5.1.32","v5.1.33","v5.1.34","v5.1.35","v5.1.36","v5.1.37","v5.1.38","v5.1.39","v5.1.4","v5.1.40","v5.1.41","v5.1.42","v5.1.43","v5.1.44","v5.1.45","v5.1.46","v5.1.5","v5.1.6","v5.1.7","v5.1.8","v5.1.9","v5.2.0","v5.2.0-beta1","v5.2.1","v5.2.10","v5.2.11","v5.2.12","v5.2.13","v5.2.14","v5.2.15","v5.2.16","v5.2.17","v5.2.18","v5.2.19","v5.2.2","v5.2.20","v5.2.21","v5.2.22","v5.2.23","v5.2.24","v5.2.25","v5.2.26","v5.2.27","v5.2.28","v5.2.29","v5.2.3","v5.2.30","v5.2.31","v5.2.32","v5.2.33","v5.2.34","v5.2.35","v5.2.36","v5.2.37","v5.2.38","v5.2.39","v5.2.4","v5.2.40","v5.2.42","v5.2.43","v5.2.44","v5.2.45","v5.2.5","v5.2.6","v5.2.7","v5.2.8","v5.2.9","v5.3.0","v5.3.0-RC1","v5.3.1","v5.3.10","v5.3.11","v5.3.12","v5.3.13","v5.3.14","v5.3.15","v5.3.16","v5.3.17","v5.3.18","v5.3.19","v5.3.2","v5.3.20","v5.3.21","v5.3.22","v5.3.23","v5.3.24","v5.3.25","v5.3.26","v5.3.27","v5.3.28","v5.3.29","v5.3.3","v5.3.30","v5.3.31","v5.3.4","v5.3.5","v5.3.6","v5.3.7","v5.3.8","v5.3.9","v5.4.0","v5.4.1","v5.4.10","v5.4.11","v5.4.12","v5.4.13","v5.4.14","v5.4.15","v5.4.16","v5.4.17","v5.4.18","v5.4.19","v5.4.2","v5.4.20","v5.4.21","v5.4.22","v5.4.23","v5.4.24","v5.4.25","v5.4.26","v5.4.27","v5.4.28","v5.4.29","v5.4.3","v5.4.30","v5.4.31","v5.4.32","v5.4.33","v5.4.34","v5.4.35","v5.4.36","v5.4.4","v5.4.5","v5.4.6","v5.4.7","v5.4.8","v5.4.9","v5.5.0","v5.5.1","v5.5.10","v5.5.11","v5.5.12","v5.5.13","v5.5.14","v5.5.15","v5.5.16","v5.5.17","v5.5.18","v5.5.19","v5.5.2","v5.5.20","v5.5.21","v5.5.22","v5.5.23","v5.5.24","v5.5.25","v5.5.26","v5.5.27","v5.5.28","v5.5.29","v5.5.3","v5.5.30","v5.5.31","v5.5.32","v5.5.33","v5.5.34","v5.5.35","v5.5.36","v5.5.37","v5.5.38","v5.5.39","v5.5.4","v5.5.5","v5.5.6","v5.5.7","v5.5.8","v5.5.9"]},{"source":"osv","ecosystem":"Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.0"},{"fixed":"5.6.15"}]}],"versions":["v5.6.0","v5.6.1","v5.6.10","v5.6.11","v5.6.12","v5.6.13","v5.6.14","v5.6.2","v5.6.3","v5.6.4","v5.6.5","v5.6.6","v5.6.7","v5.6.8","v5.6.9"]},{"source":"osv","ecosystem":"Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.5.40"}]}],"versions":["5.0.30","5.2.41","v4.0.0","v4.0.0-BETA2","v4.0.0-BETA3","v4.0.0-BETA4","v4.0.1","v4.0.10","v4.0.11","v4.0.2","v4.0.3","v4.0.4","v4.0.5","v4.0.6","v4.0.7","v4.0.8","v4.0.9","v4.1.0","v4.1.1","v4.1.10","v4.1.11","v4.1.12","v4.1.13","v4.1.14","v4.1.15","v4.1.16","v4.1.17","v4.1.18","v4.1.19","v4.1.2","v4.1.20","v4.1.21","v4.1.22","v4.1.23","v4.1.24","v4.1.25","v4.1.26","v4.1.27","v4.1.28","v4.1.29","v4.1.3","v4.1.30","v4.1.31","v4.1.4","v4.1.5","v4.1.6","v4.1.7","v4.1.8","v4.1.9","v4.2.0","v4.2.0-BETA1","v4.2.1","v4.2.10","v4.2.11","v4.2.12","v4.2.13","v4.2.14","v4.2.15","v4.2.16","v4.2.17","v4.2.18","v4.2.19","v4.2.2","v4.2.20","v4.2.21","v4.2.22","v4.2.3","v4.2.4","v4.2.5","v4.2.6","v4.2.7","v4.2.8","v4.2.9","v5.0.0","v5.0.1","v5.0.10","v5.0.11","v5.0.12","v5.0.13","v5.0.14","v5.0.15","v5.0.16","v5.0.17","v5.0.18","v5.0.19","v5.0.2","v5.0.20","v5.0.21","v5.0.22","v5.0.23","v5.0.24","v5.0.25","v5.0.26","v5.0.27","v5.0.28","v5.0.29","v5.0.3","v5.0.31","v5.0.32","v5.0.33","v5.0.34","v5.0.35","v5.0.4","v5.0.5","v5.0.6","v5.0.7","v5.0.8","v5.0.9","v5.1.0","v5.1.1","v5.1.10","v5.1.11","v5.1.12","v5.1.13","v5.1.14","v5.1.15","v5.1.16","v5.1.17","v5.1.18","v5.1.19","v5.1.2","v5.1.20","v5.1.21","v5.1.22","v5.1.23","v5.1.24","v5.1.25","v5.1.26","v5.1.27","v5.1.28","v5.1.29","v5.1.3","v5.1.30","v5.1.31","v5.1.32","v5.1.33","v5.1.34","v5.1.35","v5.1.36","v5.1.37","v5.1.38","v5.1.39","v5.1.4","v5.1.40","v5.1.41","v5.1.42","v5.1.43","v5.1.44","v5.1.45","v5.1.46","v5.1.5","v5.1.6","v5.1.7","v5.1.8","v5.1.9","v5.2.0","v5.2.0-beta1","v5.2.1","v5.2.10","v5.2.11","v5.2.12","v5.2.13","v5.2.14","v5.2.15","v5.2.16","v5.2.17","v5.2.18","v5.2.19","v5.2.2","v5.2.20","v5.2.21","v5.2.22","v5.2.23","v5.2.24","v5.2.25","v5.2.26","v5.2.27","v5.2.28","v5.2.29","v5.2.3","v5.2.30","v5.2.31","v5.2.32","v5.2.33","v5.2.34","v5.2.35","v5.2.36","v5.2.37","v5.2.38","v5.2.39","v5.2.4","v5.2.40","v5.2.42","v5.2.43","v5.2.44","v5.2.45","v5.2.5","v5.2.6","v5.2.7","v5.2.8","v5.2.9","v5.3.0","v5.3.0-RC1","v5.3.1","v5.3.10","v5.3.11","v5.3.12","v5.3.13","v5.3.14","v5.3.15","v5.3.16","v5.3.17","v5.3.18","v5.3.19","v5.3.2","v5.3.20","v5.3.21","v5.3.22","v5.3.23","v5.3.24","v5.3.25","v5.3.26","v5.3.27","v5.3.28","v5.3.29","v5.3.3","v5.3.30","v5.3.31","v5.3.4","v5.3.5","v5.3.6","v5.3.7","v5.3.8","v5.3.9","v5.4.0","v5.4.1","v5.4.10","v5.4.11","v5.4.12","v5.4.13","v5.4.14","v5.4.15","v5.4.16","v5.4.17","v5.4.18","v5.4.19","v5.4.2","v5.4.20","v5.4.21","v5.4.22","v5.4.23","v5.4.24","v5.4.25","v5.4.26","v5.4.27","v5.4.28","v5.4.29","v5.4.3","v5.4.30","v5.4.31","v5.4.32","v5.4.33","v5.4.34","v5.4.35","v5.4.36","v5.4.4","v5.4.5","v5.4.6","v5.4.7","v5.4.8","v5.4.9","v5.5.0","v5.5.1","v5.5.10","v5.5.11","v5.5.12","v5.5.13","v5.5.14","v5.5.15","v5.5.16","v5.5.17","v5.5.18","v5.5.19","v5.5.2","v5.5.20","v5.5.21","v5.5.22","v5.5.23","v5.5.24","v5.5.25","v5.5.26","v5.5.27","v5.5.28","v5.5.29","v5.5.3","v5.5.30","v5.5.31","v5.5.32","v5.5.33","v5.5.34","v5.5.35","v5.5.36","v5.5.37","v5.5.38","v5.5.39","v5.5.4","v5.5.40","v5.5.5","v5.5.6","v5.5.7","v5.5.8","v5.5.9"]},{"source":"osv","ecosystem":"Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.0"},{"fixed":"5.6.30"}]}],"versions":["v5.6.0","v5.6.1","v5.6.10","v5.6.11","v5.6.12","v5.6.13","v5.6.14","v5.6.15","v5.6.16","v5.6.17","v5.6.18","v5.6.19","v5.6.2","v5.6.20","v5.6.21","v5.6.22","v5.6.23","v5.6.24","v5.6.25","v5.6.26","v5.6.27","v5.6.28","v5.6.29","v5.6.3","v5.6.4","v5.6.5","v5.6.6","v5.6.7","v5.6.8","v5.6.9"]}],"products":[{"vendor":"laravel","product":"laravel"},{"vendor":"laravel","product":"laravel framework"}],"references":[{"url":"https://laravel.com/docs/5.6/upgrade#upgrade-5.6.30","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://packetstormsecurity.com/files/153641/PHP-Laravel-Framework-Token-Unserialize-Remote-Command-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-15133","tags":["government-resource","US Government Resource","web"]},{"url":"https://github.com/laravel/framework/commit/28e53f23a76206fb130e9a54eb95aa3f010e79c9","tags":["web"]},{"url":"https://github.com/laravel/framework/commit/886d261df0854426b4662b7ed5db6a1c575a4279","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/2018-03-30-1.yaml","tags":["web"]},{"url":"https://medium.com/@taylorotwell/laravel-security-release-5-6-15-and-5-5-40-56f1257933a0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7852-w36x-6mf6"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-15133","tags":["advisory"]},{"url":"https://github.com/laravel/framework/commit/d84cf988ed5d4661a4bf1fdcb08f5073835083a0","tags":["web"]},{"url":"https://github.com/kozmic/laravel-poc-CVE-2018-15133","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qvqm-h22r-4cp9"},{"url":"https://github.com/laravel/framework","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2018-15133","description":"In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.","status":"published","published":"2018-08-09T19:00:00Z","modified":"2025-10-21T23:45:49.105Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:35:03.288698Z"}],"euvd":[{"id":"EUVD-2022-5039","description":"In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.","status":"published","published":"2018-08-09T19:00:00Z","modified":"2025-10-21T23:45:49Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2024-01-16","updated_at":"2026-11-02T20:31:23.427989Z"}],"ghsa":[{"id":"GHSA-qvqm-h22r-4cp9","title":"Laravel Framework RCE Vulnerability","description":"In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in `Illuminate/Encryption/Encrypter.php` and PendingBroadcast in `gadgetchains/Laravel/RCE/3/chain.php` in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.","status":"published","published":"2022-05-14T00:56:30Z","modified":"2025-01-13T14:08:13Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:38:27.067633Z"},{"id":"GHSA-7852-w36x-6mf6","title":"Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior","description":"The Laravel Encrypter component is susceptible to a vulnerability that may result in decryption failure, leading to an unexpected return of `false`. Exploiting this issue requires the attacker to manipulate the encrypted payload before decryption. When combined with weak type comparisons in the application's code, such as the example below:\n\n```\n\u003c?php\n\n$decyptedValue = decrypt($secret);\n\nif ($decryptedValue == '') {\n    // Code is run even though decrypted value is false...\n}\n```","status":"published","published":"2024-05-15T22:08:06Z","modified":"2024-05-15T22:08:07Z","cwes":["CWE-1240"],"updated_at":"2026-11-02T14:37:49.987036Z"}],"kev":[{"id":"CVE-2018-15133","title":"Laravel Deserialization of Untrusted Data Vulnerability","description":"Laravel Framework contains a deserialization of untrusted data vulnerability, allowing for remote command execution. This vulnerability may only be exploited if a malicious user has accessed the application encryption key (APP_KEY environment variable).","cwes":["CWE-502"],"kev":{"date_added":"2024-01-16","due_date":"2024-02-06","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2018-15133","description":"In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.","status":"published","published":"2018-08-09T19:29:00.333Z","modified":"2026-06-17T01:42:06.387Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:04:35.310988Z"}],"osv":[{"id":"CVE-2018-15133","description":"In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.","status":"published","published":"2018-08-09T19:29:00.333Z","modified":"2026-10-24T10:30:24.814955999Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:08.242347Z"},{"id":"GHSA-qvqm-h22r-4cp9","title":"Laravel Framework RCE Vulnerability","description":"In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in `Illuminate/Encryption/Encrypter.php` and PendingBroadcast in `gadgetchains/Laravel/RCE/3/chain.php` in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.","status":"published","published":"2022-05-14T00:56:30Z","modified":"2025-01-13T15:00:54.255052Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:55.122811Z"},{"id":"CLSA-2026-1773017339","title":"TuxCare security update for laravel/framework (10 CVEs)","description":"TuxCare rebuilt laravel/framework to address 10 CVEs. Fixed in 5.4.36-p2+tuxcare.","status":"published","published":"2026-08-04T14:52:34Z","modified":"2026-10-15T09:48:04.641650282Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"GHSA-7852-w36x-6mf6","title":"Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior","description":"The Laravel Encrypter component is susceptible to a vulnerability that may result in decryption failure, leading to an unexpected return of `false`. Exploiting this issue requires the attacker to manipulate the encrypted payload before decryption. When combined with weak type comparisons in the application's code, such as the example below:\n\n```\n\u003c?php\n\n$decyptedValue = decrypt($secret);\n\nif ($decryptedValue == '') {\n    // Code is run even though decrypted value is false...\n}\n```","status":"published","published":"2024-05-15T22:08:06Z","modified":"2024-11-29T05:40:57.344982Z","cwes":["CWE-1240"],"updated_at":"2026-11-02T15:46:40.657155Z"}]}}