Advisories / composer / laravel

composer

laravel/framework

Security advisories for laravel/framework, newest first. 30 known, 1 without a fix yet.

RSS feed Check your lock file →

Latest version

13.39.0

Advisories

30 · 1 unfixed

Last advisory

23 Oct 2026

Safe from

no fix for all yet

30 advisories · newest first

CRITICAL 23 Oct 2026

Laravel TokenGuard authentication bypass through non-string API credentials

GHSA-f9x3-7vq9-cph6 · CVE-2026-114509

Affected

< 12.68.0 ≥ 13.0.0, < 13.29.0

Fixed in

12.68.0 13.29.0

Published

23 Oct 2026

MODERATE6.5 23 Oct 2026

Laravel relationship inclusion can trigger unauthorized data destruction

GHSA-5wcm-3v2w-8362 · CVE-2026-114508

Affected

≥ 12.45.0, < 12.68.0 ≥ 13.0.0, < 13.27.0

Fixed in

12.68.0 13.27.0

Published

23 Oct 2026

LOW3.1 29 Sep 2026

Laravel: XSS in Debug Page Information

GHSA-jh5r-qr3c-85q8 · CVE-2026-102279

Affected

< 12.69.0 ≥ 13.0.0, < 13.30.0

Fixed in

12.69.0 13.30.0

Published

29 Sep 2026

MODERATE4.2 17 Jun 2026

Laravel Framework: Temporary Signed URL Path Confusion

GHSA-crmm-hgp2-wgrp

Affected

< 12.61.1 ≥ 13.0.0, < 13.12.0

Fixed in

12.61.1 13.12.0

Published

17 Jun 2026

HIGH8.9 17 Jun 2026

Laravel Framework: CRLF injection in default email rule

GHSA-5vg9-5847-vvmq

Affected

< 12.60.0 ≥ 13.0.0, ≤ 13.9.0

Fixed in

12.60.0

Published

17 Jun 2026

UNRATED8.9 19 May 2026

Laravel CRLF injection in default email rule

GHSA-5vg9-5847-vvmq · CVE-2026-48019

Affected

≥ 9.0.0, < 12.60.0 ≥ 13.0.0, < 13.10.0

Fixed in

12.60.0 13.10.0

Published

19 May 2026

MODERATE 5 Mar 2025

Laravel has a File Validation Bypass

GHSA-78fx-h6xr-vch4 · CVE-2025-27515

Affected

< 10.48.29 ≥ 11.0.0, < 11.44.1 ≥ 12.0.0, < 12.1.1

Fixed in

10.48.29 11.44.1 12.1.1

Published

5 Mar 2025

MODERATE8.0 13 Dec 2024

Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page

PKSA-qzrn-rnz3-85w1 · CVE-2024-13918

Affected

≥ 11.9.0, < 11.36.0

Fixed in

11.36.0

Published

13 Dec 2024

MODERATE8.0 13 Dec 2024

Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page

PKSA-q46n-4fdk-zjr4 · CVE-2024-13919

Affected

≥ 11.9.0, < 11.36.0

Fixed in

11.36.0

Published

13 Dec 2024

HIGH0.0 12 Nov 2024

Laravel environment manipulation via query string

GHSA-gv7v-rgg6-548h · CVE-2024-52301

Affected

< 6.20.45 ≥ 7.0.0, < 7.30.7 ≥ 8.0.0, < 8.83.28

and 3 more

≥ 9.0.0, < 9.52.17 ≥ 10.0.0, < 10.48.23 ≥ 11.0.0, < 11.31.0

Fixed in

6.20.45 7.30.7 8.83.28

and 3 more

9.52.17 10.48.23 11.31.0

Published

12 Nov 2024

MODERATE 15 May 2024

Laravel Hijacked authentication cookies vulnerability

GHSA-p62r-7637-3wwc

Affected

≥ 4.0.0, < 4.1.26

Fixed in

4.1.26

Published

15 May 2024

MODERATE 15 May 2024

Laravel Risk of mass-assignment vulnerabilities

GHSA-rj3w-99gc-8j58

Affected

≥ 4.0.0, < 4.1.29

Fixed in

4.1.29

Published

15 May 2024

CRITICAL9.8 14 May 2022

Laravel Framework Deserialization Vulnerability

GHSA-pfg4-p438-p874 · CVE-2019-9081

Affected

≥ 5.7.0, < 6.20.44

Fixed in

6.20.44

Published

14 May 2022

HIGH8.1 14 May 2022

Laravel Framework RCE Vulnerability

GHSA-qvqm-h22r-4cp9 · CVE-2018-15133

Affected

≤ 5.5.40 ≥ 5.6.0, ≤ 5.6.29

Fixed in

no fix yet

Published

14 May 2022

HIGH8.8 6 Jan 2022

OS Command Injection in Laravel Framework

GHSA-w2pm-r78h-4m7v · CVE-2020-19316

Affected

< 5.8.17

Fixed in

5.8.17

Published

6 Jan 2022

UNRATED9.8 18 Nov 2021

Image upload bypass

PKSA-p3rx-dfwp-73ny · CVE-2021-43617

Affected

≥ 8.0.0, < 8.71.0

Fixed in

8.71.0

Published

18 Nov 2021

HIGH7.5 6 May 2021

Improper Input Validation in Laravel

GHSA-w68r-5p45-5rqp · CVE-2020-24941

Affected

< 6.18.35 ≥ 7.0.0, < 7.24.0

Fixed in

6.18.35 7.24.0

Published

6 May 2021

MODERATE 28 Apr 2021

SQL Server LIMIT / OFFSET SQL Injection

GHSA-4mg9-vhxq-vm7j

Affected

≥ 6.0.0, < 6.20.26 ≥ 7.0.0, < 7.30.5 ≥ 8.0.0, < 8.40.0

Fixed in

6.20.26 7.30.5 8.40.0

Published

28 Apr 2021

HIGH7.2 21 Jan 2021

Unexpected bindings in QueryBuilder

GHSA-x7p5-p2c9-phvg

Affected

≥ 6.0.0, < 6.20.14 ≥ 7.0.0, < 7.30.4 ≥ 8.0.0, < 8.24.0

Fixed in

6.20.14 7.30.4 8.24.0

Published

21 Jan 2021

MODERATE6.1 1 Jan 2021

Possible cross-site scripting (XSS) vulnerability in the Blade templating engine

GHSA-66hf-2p6w-jqfw · CVE-2021-43808

Affected

< 6.20.42 ≥ 7.0.0, < 7.30.6 ≥ 8.0.0, < 8.75.0

Fixed in

6.20.42 7.30.6 8.75.0

Published

1 Jan 2021

CRITICAL 6 Aug 2020

Guard bypass in Eloquent models

PKSA-vhvj-tvg4-96jj

Affected

≥ 5.5.0, ≤ 5.5.49 ≥ 6.0.0, < 6.18.34 ≥ 7.0.0, < 7.23.2

Fixed in

6.18.34 7.23.2

Published

6 Aug 2020

MODERATE 27 Jul 2020

RCE vulnerability in "cookie" session driver

PKSA-nrj3-r2wg-yt8b

Affected

≥ 4.1.0, < 4.3 ≥ 5.0.0, ≤ 5.5.49 ≥ 5.6.0, < 5.9

and 2 more

≥ 6.0.0, < 6.18.31 ≥ 7.0.0, < 7.22.4

Fixed in

6.18.31 7.22.4

Published

27 Jul 2020

MODERATE 13 Mar 2020

XSS vulnerability in blade templating

PKSA-rvky-x3cg-y3qd

Affected

≥ 7.0.0, < 7.1.2

Fixed in

7.1.2

Published

13 Mar 2020

HIGH5.3 13 Jan 2020

Unexpected bindings in QueryBuilder

PKSA-985r-hryy-555b · CVE-2021-21263

Affected

≥ 6.0.0, < 6.20.11 ≥ 7.0.0, < 7.30.2 ≥ 8.0.0, < 8.22.1

Fixed in

6.20.11 7.30.2 8.22.1

Published

13 Jan 2020

HIGH 8 Aug 2018

Cookie serialization vulnerability

PKSA-mhj3-vthf-h41n

Affected

≥ 4.0.0, ≤ 4.0.11 ≥ 4.1.0, ≤ 4.1.31 ≥ 4.2.0, ≤ 4.2.22

and 7 more

≥ 5.0.0, ≤ 5.0.35 ≥ 5.1.0, ≤ 5.1.46 ≥ 5.2.0, ≤ 5.2.45 ≥ 5.3.0, ≤ 5.3.31 ≥ 5.4.0, ≤ 5.4.36 ≥ 5.5.0, < 5.5.42 ≥ 5.6.0, < 5.6.30

Fixed in

5.5.42 5.6.30

Published

8 Aug 2018

HIGH 30 Mar 2018

Exploit of encryption failure vulnerability

PKSA-cn77-7mny-v9zg

Affected

≥ 4.0.0, ≤ 4.0.11 ≥ 4.1.0, ≤ 4.1.31 ≥ 4.2.0, ≤ 4.2.22

and 7 more

≥ 5.0.0, ≤ 5.0.35 ≥ 5.1.0, ≤ 5.1.46 ≥ 5.2.0, ≤ 5.2.45 ≥ 5.3.0, ≤ 5.3.31 ≥ 5.4.0, ≤ 5.4.36 ≥ 5.5.0, < 5.5.40 ≥ 5.6.0, < 5.6.15

Fixed in

5.5.40 5.6.15

Published

30 Mar 2018

MODERATE5.9 21 Sep 2017

Timing attack vector for remember me token

PKSA-xf4x-p5c1-z9xq · CVE-2017-14775

Affected

≥ 4.1.26, ≤ 4.1.31 ≥ 4.2.0, ≤ 4.2.22 ≥ 5.0.0, ≤ 5.0.35

and 5 more

≥ 5.1.0, ≤ 5.1.46 ≥ 5.2.0, ≤ 5.2.45 ≥ 5.3.0, ≤ 5.3.31 ≥ 5.4.0, ≤ 5.4.36 ≥ 5.5.0, < 5.5.10

Fixed in

5.5.10

Published

21 Sep 2017

MODERATE6.1 7 May 2017

Password reset phishing vulnerability

PKSA-fwj1-r2kg-bmxd · CVE-2017-9303

Affected

≥ 5.3.0, ≤ 5.3.31 ≥ 5.4.0, < 5.4.22

Fixed in

5.4.22

Published

7 May 2017

HIGH 20 May 2014

Risk of mass-assignment vulnerabilities

PKSA-4d28-pz9s-51zj

Affected

≥ 4.0.0, < 4.0.99 ≥ 4.1.0, < 4.1.29

Fixed in

4.0.99 4.1.29

Published

20 May 2014

HIGH 15 Apr 2014

Hijacked authentication cookies vulnerability

PKSA-gf52-cc16-7thv

Affected

≥ 4.0.0, < 4.0.99 ≥ 4.1.0, < 4.1.26

Fixed in

4.0.99 4.1.26

Published

15 Apr 2014

/advisories/composer/laravel/framework/feed.rss

From Packagist and the GitHub advisory database · synced hourly

Same vendor

laravel/laravel1 advisory

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →