{"id":"CVE-2021-43617","aliases":["CLSA-2025-1765932544","CLSA-2026-1772239984","CLSA-2026-1773103742","CLSA-2026-1773103743","CLSA-2026-1773362940","CLSA-2026-1777596011","CLSA-2026-1777596013","DEBIAN-CVE-2021-43617","EUVD-2021-2284","GHSA-364w-9g92-3grq","GHSA-4mg9-vhxq-vm7j","GHSA-qm5c-m76r-2hfr","GHSA-x7p5-p2c9-phvg"],"status":"published","title":"Withdrawn: Laravel Framework does not sufficiently block the upload of executable PHP content.","description":"Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.19963,"percentile":0.97469,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-434","CWE-89"],"published":"2021-04-29T21:52:53Z","modified":"2026-10-23T18:04:16Z","exploits":[{"source":"exploitdb","id":"EDB-50525","title":"PHP Laravel 8.70.1 - Cross Site Scripting (XSS) to Cross Site Request Forgery (CSRF)","type":"webapps","platform":"php","date":"2021-11-15","url":"https://www.exploit-db.com/exploits/50525"},{"source":"pocgithub","id":"Sybelle03/CVE-2021-43617","title":"Sybelle03/CVE-2021-43617","date":"2023-06-08","url":"https://github.com/Sybelle03/CVE-2021-43617"},{"source":"pocgithub","id":"aweiiy/CVE-2021-43617","title":"aweiiy/CVE-2021-43617","date":"2022-08-03","url":"https://github.com/aweiiy/CVE-2021-43617"},{"source":"pocgithub","id":"kombat1/CVE-2021-43617","title":"kombat1/CVE-2021-43617","date":"2021-11-19","url":"https://github.com/kombat1/CVE-2021-43617"}],"fixes":[{"ecosystem":"Packagist","package":"laravel/framework","fixed_in":["8.40.0","6.20.26","6.18.31","7.22.4"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"illuminate/database","fixed_in":["8.40.0","6.20.26"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Packagist","package":"laravel/framework","fixed_in":["5.8.38-p1+tuxcare","5.6.40-p1+tuxcare","5.7.29-p1+tuxcare","5.4.36-p3+tuxcare","5.4.36-p4+tuxcare","5.5.50-p2+tuxcare"],"sources":["osv"]},{"ecosystem":"TuxCare:Packagist","package":"illuminate/database","fixed_in":["5.4.36-p1+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"php-laravel-framework","fixed_in":["6.20.14+dfsg-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"php-laravel-framework","fixed_in":["6.20.14+dfsg-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"php-laravel-framework","fixed_in":["6.20.14+dfsg-3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.40.0"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.20.26"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"illuminate/database","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.40.0"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"illuminate/database","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.20.26"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"fixed":"6.18.31"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.22.4"}]}]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.38"},{"fixed":"5.8.38-p1+tuxcare"}]}],"versions":["5.8.38"]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"illuminate/database","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.36"},{"fixed":"5.4.36-p1+tuxcare"}]}],"versions":["5.4.36"]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.40"},{"fixed":"5.6.40-p1+tuxcare"}]}],"versions":["5.6.40"]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.29"},{"fixed":"5.7.29-p1+tuxcare"}]}],"versions":["5.7.29"]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.36"},{"fixed":"5.4.36-p3+tuxcare"}]}],"versions":["5.4.36","5.4.36-p1+tuxcare","5.4.36-p2+tuxcare"]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.36"},{"fixed":"5.4.36-p4+tuxcare"}]}],"versions":["5.4.36","5.4.36-p1+tuxcare","5.4.36-p2+tuxcare","5.4.36-p3+tuxcare"]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.50"},{"fixed":"5.5.50-p2+tuxcare"}]}],"versions":["5.5.50","5.5.50-p1+tuxcare"]},{"source":"osv","ecosystem":"Debian:12","package":"php-laravel-framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.20.14+dfsg-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"php-laravel-framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.20.14+dfsg-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"php-laravel-framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.20.14+dfsg-3"}]}]},{"source":"osv","ecosystem":"Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.40.0"}]}],"versions":["v8.0.0","v8.0.1","v8.0.2","v8.0.3","v8.0.4","v8.1.0","v8.10.0","v8.11.0","v8.11.1","v8.11.2","v8.12.0","v8.12.1","v8.12.2","v8.12.3","v8.13.0","v8.14.0","v8.15.0","v8.16.0","v8.16.1","v8.17.0","v8.17.1","v8.17.2","v8.18.0","v8.18.1","v8.19.0","v8.2.0","v8.20.0","v8.20.1","v8.21.0","v8.22.0","v8.22.1","v8.23.0","v8.23.1","v8.24.0","v8.25.0","v8.26.0","v8.26.1","v8.27.0","v8.28.0","v8.28.1","v8.29.0","v8.3.0","v8.30.0","v8.30.1","v8.31.0","v8.32.0","v8.32.1","v8.33.0","v8.33.1","v8.34.0","v8.35.0","v8.35.1","v8.36.0","v8.36.1","v8.36.2","v8.37.0","v8.38.0","v8.39.0","v8.4.0","v8.5.0","v8.6.0","v8.7.0","v8.7.1","v8.8.0","v8.9.0"]},{"source":"osv","ecosystem":"Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.20.26"}]}],"versions":["5.0.30","5.2.41","v4.0.0","v4.0.0-BETA2","v4.0.0-BETA3","v4.0.0-BETA4","v4.0.1","v4.0.10","v4.0.11","v4.0.2","v4.0.3","v4.0.4","v4.0.5","v4.0.6","v4.0.7","v4.0.8","v4.0.9","v4.1.0","v4.1.1","v4.1.10","v4.1.11","v4.1.12","v4.1.13","v4.1.14","v4.1.15","v4.1.16","v4.1.17","v4.1.18","v4.1.19","v4.1.2","v4.1.20","v4.1.21","v4.1.22","v4.1.23","v4.1.24","v4.1.25","v4.1.26","v4.1.27","v4.1.28","v4.1.29","v4.1.3","v4.1.30","v4.1.31","v4.1.4","v4.1.5","v4.1.6","v4.1.7","v4.1.8","v4.1.9","v4.2.0","v4.2.0-BETA1","v4.2.1","v4.2.10","v4.2.11","v4.2.12","v4.2.13","v4.2.14","v4.2.15","v4.2.16","v4.2.17","v4.2.18","v4.2.19","v4.2.2","v4.2.20","v4.2.21","v4.2.22","v4.2.3","v4.2.4","v4.2.5","v4.2.6","v4.2.7","v4.2.8","v4.2.9","v5.0.0","v5.0.1","v5.0.10","v5.0.11","v5.0.12","v5.0.13","v5.0.14","v5.0.15","v5.0.16","v5.0.17","v5.0.18","v5.0.19","v5.0.2","v5.0.20","v5.0.21","v5.0.22","v5.0.23","v5.0.24","v5.0.25","v5.0.26","v5.0.27","v5.0.28","v5.0.29","v5.0.3","v5.0.31","v5.0.32","v5.0.33","v5.0.34","v5.0.35","v5.0.4","v5.0.5","v5.0.6","v5.0.7","v5.0.8","v5.0.9","v5.1.0","v5.1.1","v5.1.10","v5.1.11","v5.1.12","v5.1.13","v5.1.14","v5.1.15","v5.1.16","v5.1.17","v5.1.18","v5.1.19","v5.1.2","v5.1.20","v5.1.21","v5.1.22","v5.1.23","v5.1.24","v5.1.25","v5.1.26","v5.1.27","v5.1.28","v5.1.29","v5.1.3","v5.1.30","v5.1.31","v5.1.32","v5.1.33","v5.1.34","v5.1.35","v5.1.36","v5.1.37","v5.1.38","v5.1.39","v5.1.4","v5.1.40","v5.1.41","v5.1.42","v5.1.43","v5.1.44","v5.1.45","v5.1.46","v5.1.5","v5.1.6","v5.1.7","v5.1.8","v5.1.9","v5.2.0","v5.2.0-beta1","v5.2.1","v5.2.10","v5.2.11","v5.2.12","v5.2.13","v5.2.14","v5.2.15","v5.2.16","v5.2.17","v5.2.18","v5.2.19","v5.2.2","v5.2.20","v5.2.21","v5.2.22","v5.2.23","v5.2.24","v5.2.25","v5.2.26","v5.2.27","v5.2.28","v5.2.29","v5.2.3","v5.2.30","v5.2.31","v5.2.32","v5.2.33","v5.2.34","v5.2.35","v5.2.36","v5.2.37","v5.2.38","v5.2.39","v5.2.4","v5.2.40","v5.2.42","v5.2.43","v5.2.44","v5.2.45","v5.2.5","v5.2.6","v5.2.7","v5.2.8","v5.2.9","v5.3.0","v5.3.0-RC1","v5.3.1","v5.3.10","v5.3.11","v5.3.12","v5.3.13","v5.3.14","v5.3.15","v5.3.16","v5.3.17","v5.3.18","v5.3.19","v5.3.2","v5.3.20","v5.3.21","v5.3.22","v5.3.23","v5.3.24","v5.3.25","v5.3.26","v5.3.27","v5.3.28","v5.3.29","v5.3.3","v5.3.30","v5.3.31","v5.3.4","v5.3.5","v5.3.6","v5.3.7","v5.3.8","v5.3.9","v5.4.0","v5.4.1","v5.4.10","v5.4.11","v5.4.12","v5.4.13","v5.4.14","v5.4.15","v5.4.16","v5.4.17","v5.4.18","v5.4.19","v5.4.2","v5.4.20","v5.4.21","v5.4.22","v5.4.23","v5.4.24","v5.4.25","v5.4.26","v5.4.27","v5.4.28","v5.4.29","v5.4.3","v5.4.30","v5.4.31","v5.4.32","v5.4.33","v5.4.34","v5.4.35","v5.4.36","v5.4.4","v5.4.5","v5.4.6","v5.4.7","v5.4.8","v5.4.9","v5.5.0","v5.5.1","v5.5.10","v5.5.11","v5.5.12","v5.5.13","v5.5.14","v5.5.15","v5.5.16","v5.5.17","v5.5.18","v5.5.19","v5.5.2","v5.5.20","v5.5.21","v5.5.22","v5.5.23","v5.5.24","v5.5.25","v5.5.26","v5.5.27","v5.5.28","v5.5.29","v5.5.3","v5.5.30","v5.5.31","v5.5.32","v5.5.33","v5.5.34","v5.5.35","v5.5.36","v5.5.37","v5.5.38","v5.5.39","v5.5.4","v5.5.40","v5.5.41","v5.5.42","v5.5.43","v5.5.44","v5.5.45","v5.5.46","v5.5.47","v5.5.48","v5.5.49","v5.5.5","v5.5.50","v5.5.6","v5.5.7","v5.5.8","v5.5.9","v5.6.0","v5.6.1","v5.6.10","v5.6.11","v5.6.12","v5.6.13","v5.6.14","v5.6.15","v5.6.16","v5.6.17","v5.6.18","v5.6.19","v5.6.2","v5.6.20","v5.6.21","v5.6.22","v5.6.23","v5.6.24","v5.6.25","v5.6.26","v5.6.27","v5.6.28","v5.6.29","v5.6.3","v5.6.30","v5.6.31","v5.6.32","v5.6.33","v5.6.34","v5.6.35","v5.6.36","v5.6.37","v5.6.38","v5.6.39","v5.6.4","v5.6.40","v5.6.5","v5.6.6","v5.6.7","v5.6.8","v5.6.9","v5.7.0","v5.7.1","v5.7.10","v5.7.11","v5.7.12","v5.7.13","v5.7.14","v5.7.15","v5.7.16","v5.7.17","v5.7.18","v5.7.19","v5.7.2","v5.7.20","v5.7.21","v5.7.22","v5.7.23","v5.7.24","v5.7.25","v5.7.26","v5.7.27","v5.7.28","v5.7.29","v5.7.3","v5.7.4","v5.7.5","v5.7.6","v5.7.7","v5.7.8","v5.7.9","v5.8.0","v5.8.1","v5.8.10","v5.8.11","v5.8.12","v5.8.13","v5.8.14","v5.8.15","v5.8.16","v5.8.17","v5.8.18","v5.8.19","v5.8.2","v5.8.20","v5.8.21","v5.8.22","v5.8.23","v5.8.24","v5.8.25","v5.8.26","v5.8.27","v5.8.28","v5.8.29","v5.8.3","v5.8.30","v5.8.31","v5.8.32","v5.8.33","v5.8.34","v5.8.35","v5.8.36","v5.8.37","v5.8.38","v5.8.4","v5.8.5","v5.8.6","v5.8.7","v5.8.8","v5.8.9","v6.0.0","v6.0.1","v6.0.2","v6.0.3","v6.0.4","v6.1.0","v6.10.0","v6.10.1","v6.11.0","v6.12.0","v6.13.0","v6.13.1","v6.14.0","v6.15.0","v6.15.1","v6.16.0","v6.17.0","v6.17.1","v6.18.0","v6.18.1","v6.18.10","v6.18.11","v6.18.12","v6.18.13","v6.18.14","v6.18.15","v6.18.16","v6.18.17","v6.18.18","v6.18.19","v6.18.2","v6.18.20","v6.18.21","v6.18.22","v6.18.23","v6.18.24","v6.18.25","v6.18.26","v6.18.27","v6.18.28","v6.18.29","v6.18.3","v6.18.30","v6.18.31","v6.18.32","v6.18.33","v6.18.34","v6.18.35","v6.18.36","v6.18.37","v6.18.38","v6.18.39","v6.18.4","v6.18.40","v6.18.41","v6.18.42","v6.18.43","v6.18.5","v6.18.6","v6.18.7","v6.18.8","v6.18.9","v6.19.0","v6.19.1","v6.2.0","v6.20.0","v6.20.1","v6.20.10","v6.20.11","v6.20.12","v6.20.13","v6.20.14","v6.20.15","v6.20.16","v6.20.17","v6.20.18","v6.20.19","v6.20.2","v6.20.20","v6.20.21","v6.20.22","v6.20.23","v6.20.24","v6.20.25","v6.20.3","v6.20.4","v6.20.5","v6.20.6","v6.20.7","v6.20.8","v6.20.9","v6.3.0","v6.4.0","v6.4.1","v6.5.0","v6.5.1","v6.5.2","v6.6.0","v6.6.1","v6.6.2","v6.7.0","v6.8.0","v6.9.0"]},{"source":"osv","ecosystem":"Packagist","package":"illuminate/database","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.40.0"}]}],"versions":["v8.0.0","v8.0.1","v8.0.2","v8.0.3","v8.0.4","v8.1.0","v8.10.0","v8.11.0","v8.11.1","v8.11.2","v8.12.0","v8.12.1","v8.12.2","v8.12.3","v8.13.0","v8.14.0","v8.15.0","v8.16.0","v8.16.1","v8.17.0","v8.17.2","v8.18.0","v8.18.1","v8.19.0","v8.2.0","v8.20.0","v8.20.1","v8.21.0","v8.22.0","v8.22.1","v8.23.1","v8.24.0","v8.25.0","v8.26.0","v8.26.1","v8.27.0","v8.28.0","v8.28.1","v8.29.0","v8.3.0","v8.30.0","v8.30.1","v8.31.0","v8.32.0","v8.32.1","v8.33.0","v8.33.1","v8.34.0","v8.35.0","v8.35.1","v8.36.0","v8.36.1","v8.36.2","v8.37.0","v8.38.0","v8.39.0","v8.4.0","v8.5.0","v8.6.0","v8.7.0","v8.7.1","v8.8.0","v8.9.0"]},{"source":"osv","ecosystem":"Packagist","package":"illuminate/database","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.20.26"}]}],"versions":["5.7.17","5.7.18","5.7.19","v1.0.0","v1.1.0","v1.1.1","v4.0.0","v4.0.0-BETA2","v4.0.0-BETA3","v4.0.0-BETA4","v4.0.1","v4.0.10","v4.0.2","v4.0.3","v4.0.4","v4.0.5","v4.0.6","v4.0.7","v4.0.8","v4.0.9","v4.1.0","v4.1.1","v4.1.10","v4.1.11","v4.1.12","v4.1.13","v4.1.14","v4.1.15","v4.1.16","v4.1.17","v4.1.18","v4.1.19","v4.1.2","v4.1.20","v4.1.21","v4.1.22","v4.1.23","v4.1.24","v4.1.25","v4.1.26","v4.1.27","v4.1.28","v4.1.29","v4.1.3","v4.1.30","v4.1.4","v4.1.5","v4.1.6","v4.1.7","v4.1.8","v4.1.9","v4.2.0-BETA1","v4.2.1","v4.2.12","v4.2.16","v4.2.17","v4.2.2","v4.2.3","v4.2.4","v4.2.5","v4.2.6","v4.2.7","v4.2.8","v4.2.9","v5.0.0","v5.0.22","v5.0.25","v5.0.26","v5.0.27","v5.0.28","v5.0.33","v5.0.4","v5.1.1","v5.1.13","v5.1.16","v5.1.2","v5.1.20","v5.1.22","v5.1.25","v5.1.28","v5.1.30","v5.1.31","v5.1.41","v5.1.6","v5.1.8","v5.2.0","v5.2.19","v5.2.21","v5.2.24","v5.2.25","v5.2.26","v5.2.27","v5.2.28","v5.2.31","v5.2.32","v5.2.37","v5.2.43","v5.2.45","v5.2.6","v5.2.7","v5.3.0","v5.3.16","v5.3.23","v5.3.4","v5.4.0","v5.4.13","v5.4.17","v5.4.19","v5.4.27","v5.4.36","v5.4.9","v5.5.0","v5.5.16","v5.5.17","v5.5.2","v5.5.28","v5.5.33","v5.5.34","v5.5.35","v5.5.36","v5.5.37","v5.5.39","v5.5.40","v5.5.41","v5.5.43","v5.5.44","v5.6.0","v5.6.1","v5.6.10","v5.6.11","v5.6.12","v5.6.13","v5.6.14","v5.6.15","v5.6.16","v5.6.17","v5.6.19","v5.6.2","v5.6.20","v5.6.21","v5.6.22","v5.6.23","v5.6.24","v5.6.25","v5.6.26","v5.6.27","v5.6.28","v5.6.29","v5.6.3","v5.6.30","v5.6.31","v5.6.32","v5.6.33","v5.6.34","v5.6.35","v5.6.36","v5.6.37","v5.6.38","v5.6.39","v5.6.4","v5.6.5","v5.6.6","v5.6.7","v5.6.8","v5.6.9","v5.7.0","v5.7.1","v5.7.10","v5.7.11","v5.7.15","v5.7.2","v5.7.20","v5.7.21","v5.7.22","v5.7.23","v5.7.26","v5.7.27","v5.7.28","v5.7.3","v5.7.4","v5.7.5","v5.7.6","v5.7.7","v5.7.8","v5.7.9","v5.8.0","v5.8.11","v5.8.12","v5.8.14","v5.8.15","v5.8.17","v5.8.18","v5.8.19","v5.8.2","v5.8.20","v5.8.22","v5.8.24","v5.8.27","v5.8.28","v5.8.29","v5.8.3","v5.8.30","v5.8.31","v5.8.32","v5.8.33","v5.8.34","v5.8.35","v5.8.36","v5.8.4","v5.8.8","v5.8.9","v6.0.0","v6.0.1","v6.0.2","v6.0.3","v6.0.4","v6.1.0","v6.10.0","v6.11.0","v6.12.0","v6.13.0","v6.13.1","v6.14.0","v6.15.0","v6.15.1","v6.16.0","v6.17.0","v6.17.1","v6.18.0","v6.18.1","v6.18.10","v6.18.11","v6.18.12","v6.18.13","v6.18.14","v6.18.15","v6.18.16","v6.18.17","v6.18.18","v6.18.19","v6.18.2","v6.18.20","v6.18.21","v6.18.22","v6.18.23","v6.18.24","v6.18.25","v6.18.26","v6.18.27","v6.18.28","v6.18.29","v6.18.3","v6.18.30","v6.18.31","v6.18.32","v6.18.33","v6.18.34","v6.18.35","v6.18.36","v6.18.37","v6.18.38","v6.18.39","v6.18.4","v6.18.40","v6.18.41","v6.18.42","v6.18.43","v6.18.5","v6.18.6","v6.18.7","v6.18.8","v6.18.9","v6.19.0","v6.19.1","v6.2.0","v6.20.0","v6.20.1","v6.20.10","v6.20.11","v6.20.12","v6.20.13","v6.20.14","v6.20.15","v6.20.16","v6.20.17","v6.20.18","v6.20.19","v6.20.2","v6.20.20","v6.20.21","v6.20.22","v6.20.23","v6.20.24","v6.20.25","v6.20.3","v6.20.4","v6.20.5","v6.20.6","v6.20.7","v6.20.8","v6.20.9","v6.3.0","v6.4.1","v6.5.0","v6.5.1","v6.5.2","v6.6.0","v6.6.1","v6.6.2","v6.7.0","v6.8.0"]},{"source":"osv","ecosystem":"Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"fixed":"6.18.31"}]}],"versions":["5.0.30","5.2.41","v4.1.0","v4.1.1","v4.1.10","v4.1.11","v4.1.12","v4.1.13","v4.1.14","v4.1.15","v4.1.16","v4.1.17","v4.1.18","v4.1.19","v4.1.2","v4.1.20","v4.1.21","v4.1.22","v4.1.23","v4.1.24","v4.1.25","v4.1.26","v4.1.27","v4.1.28","v4.1.29","v4.1.3","v4.1.30","v4.1.31","v4.1.4","v4.1.5","v4.1.6","v4.1.7","v4.1.8","v4.1.9","v4.2.0","v4.2.0-BETA1","v4.2.1","v4.2.10","v4.2.11","v4.2.12","v4.2.13","v4.2.14","v4.2.15","v4.2.16","v4.2.17","v4.2.18","v4.2.19","v4.2.2","v4.2.20","v4.2.21","v4.2.22","v4.2.3","v4.2.4","v4.2.5","v4.2.6","v4.2.7","v4.2.8","v4.2.9","v5.0.0","v5.0.1","v5.0.10","v5.0.11","v5.0.12","v5.0.13","v5.0.14","v5.0.15","v5.0.16","v5.0.17","v5.0.18","v5.0.19","v5.0.2","v5.0.20","v5.0.21","v5.0.22","v5.0.23","v5.0.24","v5.0.25","v5.0.26","v5.0.27","v5.0.28","v5.0.29","v5.0.3","v5.0.31","v5.0.32","v5.0.33","v5.0.34","v5.0.35","v5.0.4","v5.0.5","v5.0.6","v5.0.7","v5.0.8","v5.0.9","v5.1.0","v5.1.1","v5.1.10","v5.1.11","v5.1.12","v5.1.13","v5.1.14","v5.1.15","v5.1.16","v5.1.17","v5.1.18","v5.1.19","v5.1.2","v5.1.20","v5.1.21","v5.1.22","v5.1.23","v5.1.24","v5.1.25","v5.1.26","v5.1.27","v5.1.28","v5.1.29","v5.1.3","v5.1.30","v5.1.31","v5.1.32","v5.1.33","v5.1.34","v5.1.35","v5.1.36","v5.1.37","v5.1.38","v5.1.39","v5.1.4","v5.1.40","v5.1.41","v5.1.42","v5.1.43","v5.1.44","v5.1.45","v5.1.46","v5.1.5","v5.1.6","v5.1.7","v5.1.8","v5.1.9","v5.2.0","v5.2.0-beta1","v5.2.1","v5.2.10","v5.2.11","v5.2.12","v5.2.13","v5.2.14","v5.2.15","v5.2.16","v5.2.17","v5.2.18","v5.2.19","v5.2.2","v5.2.20","v5.2.21","v5.2.22","v5.2.23","v5.2.24","v5.2.25","v5.2.26","v5.2.27","v5.2.28","v5.2.29","v5.2.3","v5.2.30","v5.2.31","v5.2.32","v5.2.33","v5.2.34","v5.2.35","v5.2.36","v5.2.37","v5.2.38","v5.2.39","v5.2.4","v5.2.40","v5.2.42","v5.2.43","v5.2.44","v5.2.45","v5.2.5","v5.2.6","v5.2.7","v5.2.8","v5.2.9","v5.3.0","v5.3.0-RC1","v5.3.1","v5.3.10","v5.3.11","v5.3.12","v5.3.13","v5.3.14","v5.3.15","v5.3.16","v5.3.17","v5.3.18","v5.3.19","v5.3.2","v5.3.20","v5.3.21","v5.3.22","v5.3.23","v5.3.24","v5.3.25","v5.3.26","v5.3.27","v5.3.28","v5.3.29","v5.3.3","v5.3.30","v5.3.31","v5.3.4","v5.3.5","v5.3.6","v5.3.7","v5.3.8","v5.3.9","v5.4.0","v5.4.1","v5.4.10","v5.4.11","v5.4.12","v5.4.13","v5.4.14","v5.4.15","v5.4.16","v5.4.17","v5.4.18","v5.4.19","v5.4.2","v5.4.20","v5.4.21","v5.4.22","v5.4.23","v5.4.24","v5.4.25","v5.4.26","v5.4.27","v5.4.28","v5.4.29","v5.4.3","v5.4.30","v5.4.31","v5.4.32","v5.4.33","v5.4.34","v5.4.35","v5.4.36","v5.4.4","v5.4.5","v5.4.6","v5.4.7","v5.4.8","v5.4.9","v5.5.0","v5.5.1","v5.5.10","v5.5.11","v5.5.12","v5.5.13","v5.5.14","v5.5.15","v5.5.16","v5.5.17","v5.5.18","v5.5.19","v5.5.2","v5.5.20","v5.5.21","v5.5.22","v5.5.23","v5.5.24","v5.5.25","v5.5.26","v5.5.27","v5.5.28","v5.5.29","v5.5.3","v5.5.30","v5.5.31","v5.5.32","v5.5.33","v5.5.34","v5.5.35","v5.5.36","v5.5.37","v5.5.38","v5.5.39","v5.5.4","v5.5.40","v5.5.41","v5.5.42","v5.5.43","v5.5.44","v5.5.45","v5.5.46","v5.5.47","v5.5.48","v5.5.49","v5.5.5","v5.5.50","v5.5.6","v5.5.7","v5.5.8","v5.5.9","v5.6.0","v5.6.1","v5.6.10","v5.6.11","v5.6.12","v5.6.13","v5.6.14","v5.6.15","v5.6.16","v5.6.17","v5.6.18","v5.6.19","v5.6.2","v5.6.20","v5.6.21","v5.6.22","v5.6.23","v5.6.24","v5.6.25","v5.6.26","v5.6.27","v5.6.28","v5.6.29","v5.6.3","v5.6.30","v5.6.31","v5.6.32","v5.6.33","v5.6.34","v5.6.35","v5.6.36","v5.6.37","v5.6.38","v5.6.39","v5.6.4","v5.6.40","v5.6.5","v5.6.6","v5.6.7","v5.6.8","v5.6.9","v5.7.0","v5.7.1","v5.7.10","v5.7.11","v5.7.12","v5.7.13","v5.7.14","v5.7.15","v5.7.16","v5.7.17","v5.7.18","v5.7.19","v5.7.2","v5.7.20","v5.7.21","v5.7.22","v5.7.23","v5.7.24","v5.7.25","v5.7.26","v5.7.27","v5.7.28","v5.7.29","v5.7.3","v5.7.4","v5.7.5","v5.7.6","v5.7.7","v5.7.8","v5.7.9","v5.8.0","v5.8.1","v5.8.10","v5.8.11","v5.8.12","v5.8.13","v5.8.14","v5.8.15","v5.8.16","v5.8.17","v5.8.18","v5.8.19","v5.8.2","v5.8.20","v5.8.21","v5.8.22","v5.8.23","v5.8.24","v5.8.25","v5.8.26","v5.8.27","v5.8.28","v5.8.29","v5.8.3","v5.8.30","v5.8.31","v5.8.32","v5.8.33","v5.8.34","v5.8.35","v5.8.36","v5.8.37","v5.8.38","v5.8.4","v5.8.5","v5.8.6","v5.8.7","v5.8.8","v5.8.9","v6.0.0","v6.0.1","v6.0.2","v6.0.3","v6.0.4","v6.1.0","v6.10.0","v6.10.1","v6.11.0","v6.12.0","v6.13.0","v6.13.1","v6.14.0","v6.15.0","v6.15.1","v6.16.0","v6.17.0","v6.17.1","v6.18.0","v6.18.1","v6.18.10","v6.18.11","v6.18.12","v6.18.13","v6.18.14","v6.18.15","v6.18.16","v6.18.17","v6.18.18","v6.18.19","v6.18.2","v6.18.20","v6.18.21","v6.18.22","v6.18.23","v6.18.24","v6.18.25","v6.18.26","v6.18.27","v6.18.28","v6.18.29","v6.18.3","v6.18.30","v6.18.4","v6.18.5","v6.18.6","v6.18.7","v6.18.8","v6.18.9","v6.2.0","v6.3.0","v6.4.0","v6.4.1","v6.5.0","v6.5.1","v6.5.2","v6.6.0","v6.6.1","v6.6.2","v6.7.0","v6.8.0","v6.9.0"]},{"source":"osv","ecosystem":"Packagist","package":"laravel/framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.22.4"}]}],"versions":["v7.0.0","v7.0.1","v7.0.2","v7.0.3","v7.0.4","v7.0.5","v7.0.6","v7.0.7","v7.0.8","v7.1.0","v7.1.1","v7.1.2","v7.1.3","v7.10.0","v7.10.1","v7.10.2","v7.10.3","v7.11.0","v7.12.0","v7.13.0","v7.14.0","v7.14.1","v7.15.0","v7.16.0","v7.16.1","v7.17.0","v7.17.1","v7.17.2","v7.18.0","v7.19.0","v7.19.1","v7.2.0","v7.2.1","v7.2.2","v7.20.0","v7.21.0","v7.22.0","v7.22.1","v7.22.2","v7.22.3","v7.3.0","v7.4.0","v7.5.0","v7.5.1","v7.5.2","v7.6.0","v7.6.1","v7.6.2","v7.7.0","v7.7.1","v7.8.0","v7.8.1","v7.9.0","v7.9.1","v7.9.2"]}],"products":[{"vendor":"laravel","product":"framework"}],"references":[{"url":"https://github.com/laravel/framework/blob/2049de73aa099a113a287587df4cc522c90961f5/src/Illuminate/Validation/Concerns/ValidatesAttributes.php#L1331-L1333","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://salsa.debian.org/php-team/php/-/commit/dc253886b5b2e9bc8d9e36db787abb083a667fd8","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://salsa.debian.org/php-team/php/-/blob/dc253886b5b2e9bc8d9e36db787abb083a667fd8/debian/php-cgi.conf#L5-6","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-43617","tags":["advisory"]},{"url":"https://github.com/laravel/framework/blob/2049de73aa099a113a287587df4cc522c90961f5/src/Illuminate/Validation/Concerns/ValidatesAttributes.php#L1130-L1132","tags":["web"]},{"url":"https://hosein-vita.medium.com/laravel-8-x-image-upload-bypass-zero-day-852bd806019b","tags":["web"]},{"url":"https://github.com/advisories/GHSA-364w-9g92-3grq"},{"url":"https://github.com/laravel/framework/security/advisories/GHSA-4mg9-vhxq-vm7j","tags":["web"]},{"url":"https://packagist.org/packages/illuminate/database","tags":["web"]},{"url":"https://packagist.org/packages/laravel/framework","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4mg9-vhxq-vm7j"},{"url":"https://blog.laravel.com/laravel-cookie-security-releases","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/2020-07-27-1.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qm5c-m76r-2hfr"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-43617","tags":["advisory"]},{"url":"https://github.com/laravel/framework","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-43617","description":"Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.","status":"published","published":"2021-11-14T15:32:39Z","modified":"2024-08-04T04:03:08.437Z","updated_at":"2026-11-02T14:32:57.033395Z"}],"euvd":[{"id":"EUVD-2021-2284","description":"Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.","status":"published","published":"2021-11-14T15:32:39Z","modified":"2024-08-04T04:03:08Z","updated_at":"2026-11-03T03:24:13.772922Z"}],"ghsa":[{"id":"GHSA-qm5c-m76r-2hfr","title":"Laravel RCE vulnerability in \"cookie\" session driver","description":"Applications using the \"cookie\" session driver that were also exposing an encryption oracle via their application were vulnerable to remote code execution. An encryption oracle is a mechanism where arbitrary user input is encrypted and the encrypted string is later displayed or exposed to the user. This combination of scenarios lets the user generate valid Laravel signed encryption strings for any plain-text string, thus allowing them to craft Laravel session payloads when an application is using the \"cookie\" driver.","status":"published","published":"2024-05-15T22:16:52Z","modified":"2024-05-15T22:16:52Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T14:37:49.987036Z"},{"id":"GHSA-364w-9g92-3grq","title":"Withdrawn: Laravel Framework does not sufficiently block the upload of executable PHP content.","description":"# Withdrawn\n\nThis advisory has been withdrawn after the maintainers of Laravel noted this issue is not a security vulnerability with Laravel itself, but rather a userland issue.\n\n## Original CVE based description\n\nLaravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. In some use cases, this may be related to file-type validation for image upload (e.g., differences between getClientOriginalExtension and other approaches).","status":"withdrawn","published":"2021-11-16T23:40:08Z","modified":"2023-02-01T05:06:32Z","cwes":["CWE-434"],"updated_at":"2026-11-02T14:36:39.086869Z"},{"id":"GHSA-4mg9-vhxq-vm7j","title":"SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database","description":"### Impact\n\nThose using SQL Server with Laravel and allowing user input to be passed directly to the `limit` and `offset` functions are vulnerable to SQL injection. Other database drivers such as MySQL and Postgres are not affected by this vulnerability.\n\n### Patches\n\nThis problem has been patched on Laravel versions 6.20.26, 7.30.5, and 8.40.0.\n\n### Workarounds\n\nYou may workaround this vulnerability by ensuring that only integers are passed to the `limit` and `offset` functions, as well as the `skip` and `take` functions.\n","status":"published","published":"2021-04-29T21:52:53Z","modified":"2023-01-09T05:04:39Z","cwes":["CWE-89"],"updated_at":"2026-11-02T14:36:10.502376Z"}],"nvd":[{"id":"CVE-2021-43617","description":"Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.","status":"published","published":"2021-11-14T16:15:08.61Z","modified":"2026-06-17T04:11:12.143Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:07:00.984108Z"}],"osv":[{"id":"CVE-2021-43617","description":"Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.","status":"published","published":"2021-11-14T16:15:08.61Z","modified":"2026-10-20T10:55:02.658468706Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:21.877444Z"},{"id":"DEBIAN-CVE-2021-43617","description":"Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.","status":"published","published":"2021-11-14T16:15:08.61Z","modified":"2026-10-23T18:04:16.44197881Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:35.799676Z"},{"id":"GHSA-qm5c-m76r-2hfr","title":"Laravel RCE vulnerability in \"cookie\" session driver","description":"Applications using the \"cookie\" session driver that were also exposing an encryption oracle via their application were vulnerable to remote code execution. An encryption oracle is a mechanism where arbitrary user input is encrypted and the encrypted string is later displayed or exposed to the user. This combination of scenarios lets the user generate valid Laravel signed encryption strings for any plain-text string, thus allowing them to craft Laravel session payloads when an application is using the \"cookie\" driver.","status":"published","published":"2024-05-15T22:16:52Z","modified":"2024-11-29T05:40:19.902767Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:46:54.760124Z"},{"id":"CLSA-2025-1765932544","title":"TuxCare security update for laravel/framework (5 CVEs)","description":"TuxCare rebuilt laravel/framework to address 5 CVEs. Fixed in 5.8.38-p1+tuxcare.","status":"published","published":"2026-08-04T14:52:34Z","modified":"2026-10-15T09:47:21.320862423Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"CLSA-2026-1772239984","title":"TuxCare security update for illuminate/database (1 CVE)","description":"TuxCare rebuilt illuminate/database to address 1 CVE. Fixed in 5.4.36-p1+tuxcare.","status":"published","published":"2026-08-04T14:52:36Z","modified":"2026-10-15T09:48:04.681748721Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1773103742","title":"TuxCare security update for laravel/framework (9 CVEs)","description":"TuxCare rebuilt laravel/framework to address 9 CVEs. Fixed in 5.6.40-p1+tuxcare.","status":"published","published":"2026-08-04T14:52:34Z","modified":"2026-10-15T09:47:59.517840721Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1773103743","title":"TuxCare security update for laravel/framework (9 CVEs)","description":"TuxCare rebuilt laravel/framework to address 9 CVEs. Fixed in 5.7.29-p1+tuxcare.","status":"published","published":"2026-08-04T14:52:34Z","modified":"2026-10-15T09:47:59.556426054Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1773362940","title":"TuxCare security update for laravel/framework (1 CVE)","description":"TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 5.4.36-p3+tuxcare.","status":"published","published":"2026-08-04T14:52:34Z","modified":"2026-10-15T09:47:59.574878603Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1777596011","title":"TuxCare security update for laravel/framework (1 CVE)","description":"TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 5.4.36-p4+tuxcare.","status":"published","published":"2026-08-04T14:52:29Z","modified":"2026-10-15T09:47:59.549259354Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777596013","title":"TuxCare security update for laravel/framework (2 CVEs)","description":"TuxCare rebuilt laravel/framework to address 2 CVEs. Fixed in 5.5.50-p2+tuxcare.","status":"published","published":"2026-08-04T14:52:30Z","modified":"2026-10-15T09:47:59.544148585Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"GHSA-364w-9g92-3grq","title":"Withdrawn: Laravel Framework does not sufficiently block the upload of executable PHP content.","description":"# Withdrawn\n\nThis advisory has been withdrawn after the maintainers of Laravel noted this issue is not a security vulnerability with Laravel itself, but rather a userland issue.\n\n## Original CVE based description\n\nLaravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. In some use cases, this may be related to file-type validation for image upload (e.g., differences between getClientOriginalExtension and other approaches).","status":"withdrawn","published":"2021-11-16T23:40:08Z","modified":"2026-09-10T03:49:09.430802426Z","cwes":["CWE-434"],"updated_at":"2026-11-02T15:46:35.406455Z"},{"id":"GHSA-4mg9-vhxq-vm7j","title":"SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database","description":"### Impact\n\nThose using SQL Server with Laravel and allowing user input to be passed directly to the `limit` and `offset` functions are vulnerable to SQL injection. Other database drivers such as MySQL and Postgres are not affected by this vulnerability.\n\n### Patches\n\nThis problem has been patched on Laravel versions 6.20.26, 7.30.5, and 8.40.0.\n\n### Workarounds\n\nYou may workaround this vulnerability by ensuring that only integers are passed to the `limit` and `offset` functions, as well as the `skip` and `take` functions.\n","status":"published","published":"2021-04-29T21:52:53Z","modified":"2024-12-02T05:40:15.245335Z","cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:37.148947Z"}]}}