{"id":"CVE-2023-24249","aliases":["EUVD-2023-0705","GHSA-g857-47pm-3r32"],"status":"published","title":"laravel-admin has Arbitrary File Upload vulnerability","description":"An arbitrary file upload vulnerability in laravel-admin v1.8.19 allows attackers to execute arbitrary code via a crafted PHP file.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02402,"percentile":0.84153,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-434"],"published":"2023-02-27T00:00:00Z","modified":"2026-10-28T02:30:56Z","exploits":[{"source":"pocgithub","id":"IDUZZEL/CVE-2023-24249-Exploit","title":"IDUZZEL/CVE-2023-24249-Exploit","date":"2024-08-07","url":"https://github.com/IDUZZEL/CVE-2023-24249-Exploit"},{"source":"pocgithub","id":"ldb33/CVE-2023-24249-PoC","title":"ldb33/CVE-2023-24249-PoC","date":"2025-06-21","url":"https://github.com/ldb33/CVE-2023-24249-PoC"}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"encore/laravel-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.8.19"}]}]},{"source":"osv","ecosystem":"Packagist","package":"encore/laravel-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.8.19"}]}],"versions":["v1.1.6","v1.2.10","v1.2.6","v1.2.8","v1.2.9","v1.3.3","v1.3.4","v1.4.1","v1.4.4","v1.4.5","v1.4.6","v1.5.10","v1.5.11","v1.5.12","v1.5.13","v1.5.14","v1.5.15","v1.5.16","v1.5.17","v1.5.18","v1.5.19","v1.5.5","v1.5.6","v1.5.7","v1.5.8","v1.5.9","v1.6.0","v1.6.1","v1.6.10","v1.6.11","v1.6.12","v1.6.13","v1.6.14","v1.6.15","v1.6.2","v1.6.3","v1.6.4","v1.6.5","v1.6.6","v1.6.7","v1.6.8","v1.6.9","v1.7.0","v1.7.1","v1.7.11","v1.7.12","v1.7.13","v1.7.14","v1.7.15","v1.7.16","v1.7.2","v1.7.3","v1.7.4","v1.7.5","v1.7.6","v1.7.7","v1.7.8","v1.7.9","v1.8.0","v1.8.1","v1.8.10","v1.8.11","v1.8.12","v1.8.13","v1.8.14","v1.8.15","v1.8.16","v1.8.17","v1.8.18","v1.8.19","v1.8.2","v1.8.3","v1.8.4","v1.8.5","v1.8.6","v1.8.9"]}],"products":[{"vendor":"laravel-admin","product":"laravel-admin"}],"references":[{"url":"https://laravel-admin.org/","tags":["x_transferred","Product","web"]},{"url":"https://github.com/z-song/laravel-admin","tags":["x_transferred","Product","package"]},{"url":"https://flyd.uk/post/cve-2023-24249/","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24249","tags":["advisory"]},{"url":"https://github.com/z-song/laravel-admin/issues/5726","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g857-47pm-3r32"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24249.json","tags":["advisory"]},{"url":"https://flyd.uk/post/cve-2023-24249","tags":["web"]},{"url":"https://laravel-admin.org","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-24249","description":"An arbitrary file upload vulnerability in laravel-admin v1.8.19 allows attackers to execute arbitrary code via a crafted PHP file.","status":"published","published":"2023-02-27T00:00:00Z","modified":"2025-03-11T13:45:26.866Z","updated_at":"2026-11-02T14:35:27.006218Z"}],"euvd":[{"id":"EUVD-2023-0705","description":"An arbitrary file upload vulnerability in laravel-admin v1.8.19 allows attackers to execute arbitrary code via a crafted PHP file.","status":"published","published":"2023-02-27T00:00:00Z","modified":"2025-03-11T13:45:26Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"none"}],"updated_at":"2026-11-02T20:53:07.779422Z"}],"ghsa":[{"id":"GHSA-g857-47pm-3r32","title":"laravel-admin has Arbitrary File Upload vulnerability","description":"An arbitrary file upload vulnerability in laravel-admin v1.8.19 allows attackers to execute arbitrary code via a crafted PHP file.","status":"published","published":"2023-02-27T21:30:30Z","modified":"2023-03-08T17:22:01Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:36:47.279442Z"}],"nvd":[{"id":"CVE-2023-24249","description":"An arbitrary file upload vulnerability in laravel-admin v1.8.19 allows attackers to execute arbitrary code via a crafted PHP file.","status":"published","published":"2023-02-27T19:15:11.307Z","modified":"2026-06-17T05:38:56.353Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:07:47.623983Z"}],"osv":[{"id":"GHSA-g857-47pm-3r32","title":"laravel-admin has Arbitrary File Upload vulnerability","description":"An arbitrary file upload vulnerability in laravel-admin v1.8.19 allows attackers to execute arbitrary code via a crafted PHP file.","status":"published","published":"2023-02-27T21:30:30Z","modified":"2024-02-16T08:07:12.486612Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:46:47.472172Z"},{"id":"CVE-2023-24249","description":"An arbitrary file upload vulnerability in laravel-admin v1.8.19 allows attackers to execute arbitrary code via a crafted PHP file.","status":"published","published":"2023-02-27T00:00:00Z","modified":"2026-10-28T02:30:56.144749478Z","updated_at":"2026-11-02T15:44:30.709518Z"}]}}