laravel/framework (Packagist)
Advisories
59
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 13.30.0 or later clears every advisory below that has a fix.
Upgrade commands
composer
composer require laravel/framework:^13.30.0Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-f9x3-7vq9-cph6 Laravel TokenGuard authentication bypass through non-string API credentials |
Critical EPSS 0.78% |
< 12.68.0 | 12.68.0 |
| GHSA-f9x3-7vq9-cph6 Laravel TokenGuard authentication bypass through non-string API credentials |
Critical EPSS 0.78% |
>= 13.0.0, < 13.29.0 | 13.29.0 |
| GHSA-5wcm-3v2w-8362 Laravel relationship inclusion can trigger unauthorized data destruction |
Medium EPSS 0.41% |
>= 13.0.0, < 13.27.0 | 13.27.0 |
| GHSA-5wcm-3v2w-8362 Laravel relationship inclusion can trigger unauthorized data destruction |
Medium EPSS 0.41% |
>= 12.45.0, < 12.68.0 | 12.68.0 |
| GHSA-jh5r-qr3c-85q8 Laravel: XSS in Debug Page Information |
Low EPSS 0.26% |
>= 13.0.0, < 13.30.0 | 13.30.0 |
| GHSA-jh5r-qr3c-85q8 Laravel: XSS in Debug Page Information |
Low EPSS 0.26% |
< 12.69.0 | 12.69.0 |
| GHSA-crmm-hgp2-wgrp Laravel Framework: Temporary Signed URL Path Confusion |
Medium | >= 13.0.0, < 13.12.0 | 13.12.0 |
| GHSA-crmm-hgp2-wgrp Laravel Framework: Temporary Signed URL Path Confusion |
Medium | < 12.61.1 | 12.61.1 |
| GHSA-5vg9-5847-vvmq Laravel Framework: CRLF injection in default email rule |
High EPSS 0.51% |
>= 13.0.0, < 13.10.0 | 13.10.0 |
| GHSA-5vg9-5847-vvmq Laravel Framework: CRLF injection in default email rule |
High EPSS 0.51% |
< 12.60.0 | 12.60.0 |
| GHSA-83wp-f5c3-hqqr Laravel framework susceptible to reflected cross-site scripting |
Medium EPSS 0.53% |
>= 11.9.0, < 11.36.0 | 11.36.0 |
| GHSA-546h-56qp-8jmw Laravel framework susceptible to reflected cross-site scripting |
Medium EPSS 0.60% |
>= 11.9.0, < 11.36.0 | 11.36.0 |
| GHSA-78fx-h6xr-vch4 Laravel has a File Validation Bypass |
Critical EPSS 0.75% |
< 10.48.29 | 10.48.29 |
| GHSA-78fx-h6xr-vch4 Laravel has a File Validation Bypass |
Critical EPSS 0.75% |
>= 11.0.0, < 11.44.1 | 11.44.1 |
| GHSA-78fx-h6xr-vch4 Laravel has a File Validation Bypass |
Critical EPSS 0.75% |
>= 12.0.0, < 12.1.1 | 12.1.1 |
| GHSA-gv7v-rgg6-548h Laravel environment manipulation via query string |
High EPSS 44.76% |
>= 7.0.0, < 7.30.7 | 7.30.7 |
| GHSA-gv7v-rgg6-548h Laravel environment manipulation via query string |
High EPSS 44.76% |
>= 11.0.0, < 11.31.0 | 11.31.0 |
| GHSA-gv7v-rgg6-548h Laravel environment manipulation via query string |
High EPSS 44.76% |
>= 10.0.0, < 10.48.23 | 10.48.23 |
| GHSA-gv7v-rgg6-548h Laravel environment manipulation via query string |
High EPSS 44.76% |
>= 9.0.0, < 9.52.17 | 9.52.17 |
| GHSA-gv7v-rgg6-548h Laravel environment manipulation via query string |
High EPSS 44.76% |
>= 8.0.0, < 8.83.28 | 8.83.28 |
| GHSA-gv7v-rgg6-548h Laravel environment manipulation via query string |
High EPSS 44.76% |
< 6.20.45 | 6.20.45 |
| GHSA-wq8p-mqvg-2p5h laravel framework SQL Injection via limit and offset functions |
High | >= 7.0.0, < 7.30.5 | 7.30.5 |
| GHSA-wq8p-mqvg-2p5h laravel framework SQL Injection via limit and offset functions |
High | >= 8.0.0, < 8.40.0 | 8.40.0 |
| GHSA-wq8p-mqvg-2p5h laravel framework SQL Injection via limit and offset functions |
High | >= 6.0.0, < 6.20.26 | 6.20.26 |
| GHSA-jwvj-pwww-3mj5 laravel framework Unexpected database bindings via requests |
High | >= 7.0.0, < 7.30.4 | 7.30.4 |
| GHSA-jwvj-pwww-3mj5 laravel framework Unexpected database bindings via requests |
High | >= 8.0.0, < 8.24.0 | 8.24.0 |
| GHSA-jwvj-pwww-3mj5 laravel framework Unexpected database bindings via requests |
High | >= 6.0.0, < 6.20.14 | 6.20.14 |
| GHSA-44pg-c29v-hp6r Laravel Guard bypass in Eloquent models |
Medium | >= 5.5.0, <= 5.5.49 | No fix yet |
| GHSA-44pg-c29v-hp6r Laravel Guard bypass in Eloquent models |
Medium | >= 6.0.0, < 6.18.34 | 6.18.34 |
| GHSA-44pg-c29v-hp6r Laravel Guard bypass in Eloquent models |
Medium | >= 7.0.0, < 7.23.2 | 7.23.2 |
| GHSA-qm5c-m76r-2hfr Laravel RCE vulnerability in "cookie" session driver |
Critical | >= 7.0.0, < 7.22.4 | 7.22.4 |
| GHSA-qm5c-m76r-2hfr Laravel RCE vulnerability in "cookie" session driver |
Critical | >= 4.1.0, < 6.18.31 | 6.18.31 |
| GHSA-vr95-p7q6-8m9q Laravel Cross-site Scripting (XSS) vulnerability in blade templating |
Medium | >= 7.0.0, < 7.1.2 | 7.1.2 |
| GHSA-6jvx-8ch9-j2jr Laravel Cookie serialization vulnerability |
High | >= 5.5.0, < 5.6.30 | 5.6.30 |
| GHSA-7852-w36x-6mf6 Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior |
Medium | < 5.5.40 | 5.5.40 |
| GHSA-7852-w36x-6mf6 Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior |
Medium | >= 5.6.0, < 5.6.15 | 5.6.15 |
| GHSA-p62r-7637-3wwc Laravel Hijacked authentication cookies vulnerability |
Medium | >= 4.0.0, < 4.1.26 | 4.1.26 |
| GHSA-rj3w-99gc-8j58 Laravel Risk of mass-assignment vulnerabilities |
Medium | >= 4.0.0, < 4.1.29 | 4.1.29 |
| GHSA-rc8x-jrrc-frfv Laravel does not properly constrain the host portion of a password-reset URL |
Medium EPSS 0.96% |
>= 5.4.0, < 5.4.22 | 5.4.22 |
| GHSA-rc8x-jrrc-frfv Laravel does not properly constrain the host portion of a password-reset URL |
Medium EPSS 0.96% |
>= 5.3.0, <= 5.3.31 | No fix yet |
| GHSA-c2v7-j5gq-wcq4 Laravel Sensitive Data Exposure |
Medium EPSS 1.19% |
< 5.5.10 | 5.5.10 |
| GHSA-pfg4-p438-p874 Laravel Framework Deserialization Vulnerability |
Critical | >= 5.7.0, < 6.20.44 | 6.20.44 |
| GHSA-w2pm-r78h-4m7v OS Command Injection in Laravel Framework |
High EPSS 2.52% |
< 5.8.17 | 5.8.17 |
| GHSA-66hf-2p6w-jqfw Laravel Framework XSS in Blade templating engine |
Medium EPSS 0.83% |
>= 8.0.0, < 8.75.0 | 8.75.0 |
| GHSA-66hf-2p6w-jqfw Laravel Framework XSS in Blade templating engine |
Medium EPSS 0.83% |
>= 7.0.0, < 7.30.6 | 7.30.6 |
| GHSA-66hf-2p6w-jqfw Laravel Framework XSS in Blade templating engine |
Medium EPSS 0.83% |
< 6.20.42 | 6.20.42 |
| GHSA-364w-9g92-3grq Withdrawn: Laravel Framework does not sufficiently block the upload of executable PHP content. Withdrawn |
Medium EPSS 19.96% |
<= 8.70.2 | No fix yet |
| GHSA-w68r-5p45-5rqp Improper Input Validation in Laravel |
High EPSS 1.09% |
>= 7.0.0, < 7.24.0 | 7.24.0 |
| GHSA-w68r-5p45-5rqp Improper Input Validation in Laravel |
High EPSS 1.09% |
< 6.18.35 | 6.18.35 |
| GHSA-4mg9-vhxq-vm7j SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database |
High | >= 8.0.0, < 8.40.0 | 8.40.0 |
| GHSA-4mg9-vhxq-vm7j SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database |
High | < 6.20.26 | 6.20.26 |
| GHSA-x7p5-p2c9-phvg Unexpected database bindings |
High | < 6.20.14 | 6.20.14 |
| GHSA-x7p5-p2c9-phvg Unexpected database bindings |
High | >= 7.0.0, < 7.30.4 | 7.30.4 |
| GHSA-x7p5-p2c9-phvg Unexpected database bindings |
High | >= 8.0.0, < 8.24.0 | 8.24.0 |
| GHSA-3p32-j457-pg5x Query Binding Exploitation |
High EPSS 1.62% |
>= 6.0.0, < 6.20.11 | 6.20.11 |
| GHSA-3p32-j457-pg5x Query Binding Exploitation |
High EPSS 1.62% |
>= 7.0.0, < 7.30.2 | 7.30.2 |
| GHSA-3p32-j457-pg5x Query Binding Exploitation |
High EPSS 1.62% |
>= 8.0.0, < 8.22.1 | 8.22.1 |
| CVE-2018-15133 Laravel Framework RCE Vulnerability Known exploited |
High EPSS 76.57% |
<= 5.5.40 | No fix yet |
| CVE-2018-15133 Laravel Framework RCE Vulnerability Known exploited |
High EPSS 76.57% |
>= 5.6.0, < 5.6.30 | 5.6.30 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor