Skip to content
Log inStart free trial

GHSA-5wcm-3v2w-8362 CVE-2026-114508

Laravel relationship inclusion can trigger unauthorized data destruction

Medium Packagist
Severity
6.5 / 10
Medium · CVSS 3.1
Exploit chance (EPSS)
0.41%
Chance of exploitation in the next 30 days. Higher than 34.91% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Fix
12.68.0
Upgrade laravel/framework to this version or later

Description

A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data.

Impact

A user with only read access could cause irreversible data loss (e.g., a related table being emptied), without needing any write permissions. This could result in denial of service and loss of data integrity for affected applications.

Affected versions

Packagist

PackageVulnerableFixed in
laravel/framework
>= 12.45.0, < 12.68.0
12.68.0
laravel/framework
>= 13.0.0, < 13.27.0
13.27.0

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

laravel/framework Packagist → 12.68.0

composer
composer require laravel/framework:^12.68.0

Severity breakdown

CVSS 3.1 6.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low

Weakness

CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

How to prevent it
  • Architecture and Design: Refactor your code to avoid using reflection.
  • Architecture and Design: Do not use user-controlled inputs to select and load classes or code.
  • Implementation: Apply strict input validation by using allowlists or indirect selection to ensure that the user is only selecting allowable classes or code.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
CVE-2018-15133
Laravel Framework RCE Vulnerability
High Known exploited Also affects laravel/framework
GHSA-f9x3-7vq9-cph6
Laravel TokenGuard authentication bypass through non-string API credentials
Critical Also affects laravel/framework
GHSA-jh5r-qr3c-85q8
Laravel: XSS in Debug Page Information
Low Also affects laravel/framework
GHSA-crmm-hgp2-wgrp
Laravel Framework: Temporary Signed URL Path Confusion
Medium Also affects laravel/framework
GHSA-5vg9-5847-vvmq
Laravel Framework: CRLF injection in default email rule
High Also affects laravel/framework
GHSA-83wp-f5c3-hqqr
Laravel framework susceptible to reflected cross-site scripting
Medium Also affects laravel/framework
GHSA-546h-56qp-8jmw
Laravel framework susceptible to reflected cross-site scripting
Medium Also affects laravel/framework
GHSA-78fx-h6xr-vch4
Laravel has a File Validation Bypass
Critical Also affects laravel/framework
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor