# laravel/framework (Packagist) vulnerabilities

15 known vulnerabilities (1 critical, 6 high, 3 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/laravel/framework

## Advisories (15)

### [CVE-2026-114509](https://cve.now/CVE-2026-114509): Laravel TokenGuard authentication bypass through non-string API credentials

- Severity: Critical 9.2
- Published: Oct 21, 2026
- Affected: from 13.0.0, fixed in 13.29.0; fixed in 12.68.0.

### [CVE-2026-114508](https://cve.now/CVE-2026-114508): Laravel relationship inclusion can trigger unauthorized data destruction

- Severity: Medium 6.5
- Published: Oct 21, 2026
- Affected: from 12.45.0, fixed in 12.68.0; from 13.0.0, fixed in 13.27.0.

### [CVE-2026-102279](https://cve.now/CVE-2026-102279): Laravel: XSS in Debug Page Information

- Severity: Low 3.1
- Published: Sep 28, 2026
- Affected: fixed in 12.69.0; from 13.0.0, fixed in 13.30.0.

### [CVE-2026-48019](https://cve.now/CVE-2026-48019): CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay

- Severity: High 8.9
- Published: Sep 4, 2026
- Affected: from 13.0.0, fixed in 13.10.0; fixed in 12.60.0.

### [CVE-2024-13919](https://cve.now/CVE-2024-13919): Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page

- Severity: High 8.0
- Published: Mar 10, 2025
- Affected: from 11.9.0, fixed in 11.36.0.

### [CVE-2024-13918](https://cve.now/CVE-2024-13918): Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page

- Severity: High 8.0
- Published: Mar 10, 2025
- Affected: from 11.9.0, fixed in 11.36.0.

### [CVE-2025-27515](https://cve.now/CVE-2025-27515): Laravel has a File Validation Bypass

- Severity: Medium 6.9
- Published: Mar 5, 2025
- Affected: from 12.0.0, fixed in 12.1.1; from 11.0.0, fixed in 11.44.1; fixed in 10.48.29.

### [CVE-2024-52301](https://cve.now/CVE-2024-52301): Laravel allows environment manipulation via query string

- Severity: High 8.7
- Published: Nov 12, 2024
- Affected: fixed in 6.20.45; from 7.0.0, fixed in 7.30.7; from 8.0.0, fixed in 8.83.28; from 9.0.0, fixed in 9.52.17; from 10.0.0, fixed in 10.48.23; from 11.0.0, fixed in 11.31.0.

### [CVE-2020-19316](https://cve.now/CVE-2020-19316): OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17.

- Severity: Unrated
- Published: Dec 20, 2021
- Affected: fixed in 5.8.17.

### [CVE-2021-43808](https://cve.now/CVE-2021-43808): Blade \`@parent\` Exploitation Leading To Possible XSS in Laravel

- Severity: Medium 5.3
- Published: Dec 7, 2021
- Affected: fixed in 6.20.42; from 7.0.0, fixed in 7.30.6; from 8.0.0, fixed in 8.75.0.

### [CVE-2021-21263](https://cve.now/CVE-2021-21263): Query Binding Exploitation in Laravel

- Severity: High 7.2
- Published: Jan 19, 2021
- Affected: from 8.0.0, fixed in 8.22.1; from 6.0.0, fixed in 6.20.11; from 7.0.0, fixed in 7.30.2.

### [CVE-2020-24941](https://cve.now/CVE-2020-24941): An issue was discovered in Laravel before 6.18.35 and 7.x before 7.24.0.

- Severity: Unrated
- Published: Sep 4, 2020
- Affected: fixed in 6.18.35; from 7.0.0, fixed in 7.24.0.

### [CVE-2018-15133](https://cve.now/CVE-2018-15133): In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a pote

- Severity: High 8.1 · KEV
- Published: Aug 9, 2018
- Affected: through 5.5.40; from 5.6.0, fixed in 5.6.30.

### [CVE-2017-14775](https://cve.now/CVE-2017-14775): Laravel before 5.5.10 mishandles the remember\_me token verification process because DatabaseUserProvider does not have constant-time token…

- Severity: Unrated
- Published: Sep 27, 2017
- Affected: fixed in 5.5.10.

### [CVE-2017-9303](https://cve.now/CVE-2017-9303): Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote…

- Severity: Unrated
- Published: May 29, 2017
- Affected: from 5.3.0, through 5.3.31; from 5.4.0, fixed in 5.4.22.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/laravel/framework
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.