{"id":"CVE-2021-3129","aliases":["EUVD-2021-0599","GHSA-4qwp-7c67-jmcc"],"status":"published","title":"Unauthenticated remote code execution in Ignition","description":"Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.99943,"percentile":0.99973,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-94"],"published":"2021-01-12T14:07:38Z","modified":"2026-10-20T10:54:39Z","kev":{"date_added":"2023-09-18","due_date":"2023-10-09","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2023-09-18"},{"source":"kev","since":"2023-09-18"}],"exploits":[{"source":"pocgithub","id":"ambionics/laravel-exploits","title":"ambionics/laravel-exploits","date":"2021-01-13","url":"https://github.com/ambionics/laravel-exploits"},{"source":"metasploit","id":"exploit/multi/php/ignition_laravel_debug_rce","title":"Unauthenticated remote code execution in Ignition","type":"exploit","platform":"Unix,Windows","date":"2021-01-13","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/php/ignition_laravel_debug_rce"},{"source":"exploitdb","id":"EDB-49424","title":"Laravel 8.4.2 debug mode - Remote code execution","type":"webapps","platform":"php","date":"2021-01-14","url":"https://www.exploit-db.com/exploits/49424"},{"source":"pocgithub","id":"SNCKER/CVE-2021-3129","title":"SNCKER/CVE-2021-3129","date":"2021-01-22","url":"https://github.com/SNCKER/CVE-2021-3129"},{"source":"pocgithub","id":"SecPros-Team/laravel-CVE-2021-3129-EXP","title":"SecPros-Team/laravel-CVE-2021-3129-EXP","date":"2021-01-25","url":"https://github.com/SecPros-Team/laravel-CVE-2021-3129-EXP"},{"source":"pocgithub","id":"crisprss/Laravel_CVE-2021-3129_EXP","title":"crisprss/Laravel_CVE-2021-3129_EXP","date":"2021-01-27","url":"https://github.com/crisprss/Laravel_CVE-2021-3129_EXP"},{"source":"pocgithub","id":"nth347/CVE-2021-3129_exploit","title":"nth347/CVE-2021-3129_exploit","date":"2021-01-27","url":"https://github.com/nth347/CVE-2021-3129_exploit"},{"source":"pocgithub","id":"FunPhishing/Laravel-8.4.2-rce-CVE-2021-3129","title":"FunPhishing/Laravel-8.4.2-rce-CVE-2021-3129","date":"2021-02-14","url":"https://github.com/FunPhishing/Laravel-8.4.2-rce-CVE-2021-3129"},{"source":"pocgithub","id":"zhzyker/CVE-2021-3129","title":"zhzyker/CVE-2021-3129","date":"2021-02-18","url":"https://github.com/zhzyker/CVE-2021-3129"},{"source":"pocgithub","id":"Y0s9/CVE-2021-3129","title":"Y0s9/CVE-2021-3129","date":"2021-04-11","url":"https://github.com/Y0s9/CVE-2021-3129"},{"source":"pocgithub","id":"idea-oss/laravel-CVE-2021-3129-EXP","title":"idea-oss/laravel-CVE-2021-3129-EXP","date":"2021-07-22","url":"https://github.com/idea-oss/laravel-CVE-2021-3129-EXP"},{"source":"pocgithub","id":"knqyf263/CVE-2021-3129","title":"knqyf263/CVE-2021-3129","date":"2021-10-01","url":"https://github.com/knqyf263/CVE-2021-3129"},{"source":"pocgithub","id":"cuongtop4598/CVE-2021-3129-Script","title":"cuongtop4598/CVE-2021-3129-Script","date":"2022-04-08","url":"https://github.com/cuongtop4598/CVE-2021-3129-Script"},{"source":"pocgithub","id":"joshuavanderpoll/CVE-2021-3129","title":"joshuavanderpoll/CVE-2021-3129","date":"2022-04-16","url":"https://github.com/joshuavanderpoll/CVE-2021-3129"},{"source":"pocgithub","id":"shadowabi/Laravel-CVE-2021-3129","title":"shadowabi/Laravel-CVE-2021-3129","date":"2022-06-04","url":"https://github.com/shadowabi/Laravel-CVE-2021-3129"},{"source":"pocgithub","id":"hupe1980/CVE-2021-3129","title":"hupe1980/CVE-2021-3129","date":"2022-09-30","url":"https://github.com/hupe1980/CVE-2021-3129"},{"source":"pocgithub","id":"0nion1/CVE-2021-3129","title":"0nion1/CVE-2021-3129","date":"2022-10-11","url":"https://github.com/0nion1/CVE-2021-3129"},{"source":"pocgithub","id":"MadExploits/Laravel-debug-Checker","title":"MadExploits/Laravel-debug-Checker","date":"2022-12-10","url":"https://github.com/MadExploits/Laravel-debug-Checker"},{"source":"pocgithub","id":"ajisai-babu/CVE-2021-3129-exp","title":"ajisai-babu/CVE-2021-3129-exp","date":"2023-03-04","url":"https://github.com/ajisai-babu/CVE-2021-3129-exp"},{"source":"pocgithub","id":"keyuan15/CVE-2021-3129","title":"keyuan15/CVE-2021-3129","date":"2023-03-11","url":"https://github.com/keyuan15/CVE-2021-3129"},{"source":"pocgithub","id":"Zoo1sondv/CVE-2021-3129","title":"Zoo1sondv/CVE-2021-3129","date":"2023-05-01","url":"https://github.com/Zoo1sondv/CVE-2021-3129"},{"source":"pocgithub","id":"miko550/CVE-2021-3129","title":"miko550/CVE-2021-3129","date":"2023-07-26","url":"https://github.com/miko550/CVE-2021-3129"},{"source":"pocgithub","id":"wmasday/CVE-2021-3129","title":"wmasday/CVE-2021-3129","date":"2023-07-27","url":"https://github.com/wmasday/CVE-2021-3129"},{"source":"pocgithub","id":"banyaksepuh/Mass-CVE-2021-3129-Scanner","title":"banyaksepuh/Mass-CVE-2021-3129-Scanner","date":"2023-10-22","url":"https://github.com/banyaksepuh/Mass-CVE-2021-3129-Scanner"},{"source":"pocgithub","id":"Axianke/CVE-2021-3129","title":"Axianke/CVE-2021-3129","date":"2024-01-15","url":"https://github.com/Axianke/CVE-2021-3129"},{"source":"pocgithub","id":"cc3305/CVE-2021-3129","title":"cc3305/CVE-2021-3129","date":"2024-05-19","url":"https://github.com/cc3305/CVE-2021-3129"},{"source":"pocgithub","id":"piperpwn/CVE-2021-3129-piperpwn","title":"piperpwn/CVE-2021-3129-piperpwn","date":"2024-07-16","url":"https://github.com/piperpwn/CVE-2021-3129-piperpwn"},{"source":"nuclei","id":"CVE-2021-3129","title":"Laravel with Ignition \u003c= v8.4.2 Debug Mode - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3129.yaml"}],"exploits_more":8,"fixes":[{"ecosystem":"Packagist","package":"facade/ignition","fixed_in":["2.5.2","2.4.2","1.16.14","1.6.15"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"facade/ignition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.2"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"facade/ignition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.4.2"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"facade/ignition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.0"},{"fixed":"1.16.14"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"facade/ignition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.15"}]}]},{"source":"osv","ecosystem":"Packagist","package":"facade/ignition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.2"}]}],"versions":["2.5.0","2.5.1"]},{"source":"osv","ecosystem":"Packagist","package":"facade/ignition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.4.2"}]}],"versions":["2.0.0","2.0.1","2.0.10","2.0.2","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.1.0","2.2.0","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.4.0","2.4.1"]},{"source":"osv","ecosystem":"Packagist","package":"facade/ignition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.0"},{"fixed":"1.16.14"}]}],"versions":["1.10.0","1.11.0","1.11.1","1.11.2","1.12.0","1.12.1","1.13.0","1.13.1","1.14.0","1.15.0","1.16.0","1.16.1","1.16.2","1.16.3","1.16.4","1.7.0","1.7.1","1.8.0","1.8.1","1.8.2","1.8.4","1.9.0","1.9.1","1.9.2"]},{"source":"osv","ecosystem":"Packagist","package":"facade/ignition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.15"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.1.0","1.1.1","1.2.0","1.3.0","1.4.0","1.4.1","1.4.10","1.4.11","1.4.12","1.4.13","1.4.14","1.4.15","1.4.16","1.4.17","1.4.18","1.4.19","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5.0","1.6.0","1.6.1","1.6.10","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9"]}],"products":[{"vendor":"facade","product":"ignition"},{"vendor":"laravel","product":"ignition"}],"references":[{"url":"https://www.ambionics.io/blog/laravel-debug-rce","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://github.com/facade/ignition/pull/334","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"http://packetstormsecurity.com/files/162094/Ignition-2.5.1-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence","web"]},{"url":"http://packetstormsecurity.com/files/165999/Ignition-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3129","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3129","tags":["advisory"]},{"url":"https://github.com/facade/ignition/commit/11ffca14abd22db779d90b12e193f8000f6d184b","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/facade/ignition/CVE-2021-3129.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4qwp-7c67-jmcc"},{"url":"https://github.com/facade/ignition","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-3129","description":"Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.","status":"published","published":"2021-01-12T14:07:38Z","modified":"2025-10-21T23:35:30.227Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"updated_at":"2026-11-02T14:33:03.671751Z"}],"euvd":[{"id":"EUVD-2021-0599","description":"Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.","status":"published","published":"2021-01-12T14:07:38Z","modified":"2025-10-21T23:35:30Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2023-09-18","updated_at":"2026-11-02T20:31:25.308373Z"}],"ghsa":[{"id":"GHSA-4qwp-7c67-jmcc","title":"Unauthenticated remote code execution in Ignition","description":"Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.","status":"published","published":"2021-03-29T20:23:46Z","modified":"2025-10-22T17:58:58Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:39:02.474737Z"}],"kev":[{"id":"CVE-2021-3129","title":"Laravel Ignition File Upload Vulnerability","description":"Laravel Ignition contains a file upload vulnerability that allows unauthenticated remote attackers to execute malicious code due to insecure usage of file_get_contents() and file_put_contents().","kev":{"date_added":"2023-09-18","due_date":"2023-10-09","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2021-3129","description":"Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.","status":"published","published":"2021-01-12T15:15:16.453Z","modified":"2026-06-17T04:04:43.133Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:06:49.284888Z"}],"osv":[{"id":"CVE-2021-3129","description":"Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.","status":"published","published":"2021-01-12T15:15:16.453Z","modified":"2026-10-20T10:54:39.937339209Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:19.483607Z"},{"id":"GHSA-4qwp-7c67-jmcc","title":"Unauthenticated remote code execution in Ignition","description":"Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.","status":"published","published":"2021-03-29T20:23:46Z","modified":"2025-10-22T19:32:22.659838Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:37.528068Z"}]}}