Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:composer/laravel/framework@8.70.1
Typecomposer
Namespacelaravel
Nameframework
Version8.70.1
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version10.48.29
Latest_non_vulnerable_version12.1.1
Affected_by_vulnerabilities
0
url VCID-6wn3-r4pw-a3a3
vulnerability_id VCID-6wn3-r4pw-a3a3
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Laravel is a web application framework. Laravel contain a possible cross-site scripting (XSS) vulnerability in the Blade templating engine. A broken HTML element may be clicked and the user taken to another location in their browser due to XSS. This is due to the user being able to guess the parent placeholder SHA-1 hash by trying common names of sections. If the parent template contains an exploitable HTML structure an XSS vulnerability can be exposed. This vulnerability has been patched by determining the parent placeholder at runtime and using a random hash that is unique to each request.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2021-43808
reference_id
reference_type
scores
0
value 0.00359
scoring_system epss
scoring_elements 0.58462
published_at 2026-06-06T12:55:00Z
1
value 0.00359
scoring_system epss
scoring_elements 0.58453
published_at 2026-06-05T12:55:00Z
2
value 0.00359
scoring_system epss
scoring_elements 0.58406
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2021-43808
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43808
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43808
2
reference_url https://github.com/laravel/framework
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/laravel/framework
3
reference_url https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b
4
reference_url https://github.com/laravel/framework/pull/39906
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/laravel/framework/pull/39906
5
reference_url https://github.com/laravel/framework/pull/39908
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/laravel/framework/pull/39908
6
reference_url https://github.com/laravel/framework/pull/39909
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/laravel/framework/pull/39909
7
reference_url https://github.com/laravel/framework/releases/tag/v6.20.42
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/laravel/framework/releases/tag/v6.20.42
8
reference_url https://github.com/laravel/framework/releases/tag/v7.30.6
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/laravel/framework/releases/tag/v7.30.6
9
reference_url https://github.com/laravel/framework/releases/tag/v8.75.0
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/laravel/framework/releases/tag/v8.75.0
10
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1001333
reference_id 1001333
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1001333
11
reference_url https://nvd.nist.gov/vuln/detail/CVE-2021-43808
reference_id CVE-2021-43808
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2021-43808
12
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/illuminate/view/CVE-2021-43808.yaml
reference_id CVE-2021-43808.YAML
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/illuminate/view/CVE-2021-43808.yaml
13
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/CVE-2021-43808.yaml
reference_id CVE-2021-43808.YAML
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/CVE-2021-43808.yaml
14
reference_url https://github.com/advisories/GHSA-66hf-2p6w-jqfw
reference_id GHSA-66hf-2p6w-jqfw
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-66hf-2p6w-jqfw
15
reference_url https://github.com/laravel/framework/security/advisories/GHSA-66hf-2p6w-jqfw
reference_id GHSA-66hf-2p6w-jqfw
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/laravel/framework/security/advisories/GHSA-66hf-2p6w-jqfw
fixed_packages
0
url pkg:composer/laravel/framework@8.75.0
purl pkg:composer/laravel/framework@8.75.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fhw2-erwk-fqf4
1
vulnerability VCID-su5t-5e4w-fbc2
2
vulnerability VCID-tzy8-b9et-fyd9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/laravel/framework@8.75.0
aliases CVE-2021-43808, GHSA-66hf-2p6w-jqfw
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-6wn3-r4pw-a3a3
1
url VCID-fhw2-erwk-fqf4
vulnerability_id VCID-fhw2-erwk-fqf4
summary 
Laravel environment manipulation via query string
When the `register_argc_argv php` directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-52301
reference_id
reference_type
scores
0
value 0.65712
scoring_system epss
scoring_elements 0.9852
published_at 2026-06-06T12:55:00Z
1
value 0.65712
scoring_system epss
scoring_elements 0.98521
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-52301
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52301
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52301
2
reference_url https://github.com/laravel/framework
reference_id
reference_type
scores
0
value 0.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/laravel/framework
3
reference_url https://lists.debian.org/debian-lts-announce/2024/12/msg00019.html
reference_id
reference_type
scores
0
value 0.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.debian.org/debian-lts-announce/2024/12/msg00019.html
4
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1088189
reference_id 1088189
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1088189
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-52301
reference_id CVE-2024-52301
reference_type
scores
0
value 0.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-52301
6
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/CVE-2024-52301.yaml
reference_id CVE-2024-52301.YAML
reference_type
scores
0
value 0.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/CVE-2024-52301.yaml
7
reference_url https://github.com/advisories/GHSA-gv7v-rgg6-548h
reference_id GHSA-gv7v-rgg6-548h
reference_type
scores
0
value 0.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/advisories/GHSA-gv7v-rgg6-548h
8
reference_url https://github.com/laravel/framework/security/advisories/GHSA-gv7v-rgg6-548h
reference_id GHSA-gv7v-rgg6-548h
reference_type
scores
0
value 0.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-13T14:51:08Z/
url https://github.com/laravel/framework/security/advisories/GHSA-gv7v-rgg6-548h
fixed_packages
0
url pkg:composer/laravel/framework@8.83.28
purl pkg:composer/laravel/framework@8.83.28
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-tzy8-b9et-fyd9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/laravel/framework@8.83.28
1
url pkg:composer/laravel/framework@9.0.0-beta.1
purl pkg:composer/laravel/framework@9.0.0-beta.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-su5t-5e4w-fbc2
1
vulnerability VCID-tzy8-b9et-fyd9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/laravel/framework@9.0.0-beta.1
2
url pkg:composer/laravel/framework@9.52.17
purl pkg:composer/laravel/framework@9.52.17
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-tzy8-b9et-fyd9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/laravel/framework@9.52.17
3
url pkg:composer/laravel/framework@10.48.23
purl pkg:composer/laravel/framework@10.48.23
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-tzy8-b9et-fyd9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/laravel/framework@10.48.23
4
url pkg:composer/laravel/framework@11.31.0
purl pkg:composer/laravel/framework@11.31.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4gte-7mxp-qfbf
1
vulnerability VCID-9xkc-cfyx-1qaw
2
vulnerability VCID-tzy8-b9et-fyd9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/laravel/framework@11.31.0
aliases CVE-2024-52301, GHSA-gv7v-rgg6-548h
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-fhw2-erwk-fqf4
2
url VCID-su5t-5e4w-fbc2
vulnerability_id VCID-su5t-5e4w-fbc2
summary 
Observable Discrepancy
The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a user is found to not exist.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2022-40482
reference_id
reference_type
scores
0
value 0.00481
scoring_system epss
scoring_elements 0.65477
published_at 2026-06-04T12:55:00Z
1
value 0.00481
scoring_system epss
scoring_elements 0.65528
published_at 2026-06-05T12:55:00Z
2
value 0.00481
scoring_system epss
scoring_elements 0.65539
published_at 2026-06-06T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2022-40482
1
reference_url https://ephort.dk/blog/laravel-timing-attack-vulnerability/
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-03T20:49:48Z/
url https://ephort.dk/blog/laravel-timing-attack-vulnerability/
2
reference_url https://github.com/ephort/laravel-user-enumeration-demo
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-03T20:49:48Z/
url https://github.com/ephort/laravel-user-enumeration-demo
3
reference_url https://github.com/laravel/framework/pull/44069
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-03T20:49:48Z/
url https://github.com/laravel/framework/pull/44069
4
reference_url https://github.com/laravel/framework/releases/tag/v9.32.0
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-03T20:49:48Z/
url https://github.com/laravel/framework/releases/tag/v9.32.0
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2022-40482
reference_id CVE-2022-40482
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2022-40482
fixed_packages
0
url pkg:composer/laravel/framework@9.32.0
purl pkg:composer/laravel/framework@9.32.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fhw2-erwk-fqf4
1
vulnerability VCID-tzy8-b9et-fyd9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/laravel/framework@9.32.0
aliases CVE-2022-40482
risk_score 2.4
exploitability 0.5
weighted_severity 4.8
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-su5t-5e4w-fbc2
3
url VCID-tzy8-b9et-fyd9
vulnerability_id VCID-tzy8-b9et-fyd9
summary 
Laravel has a File Validation Bypass
When using wildcard validation to validate a given file or image field array (`files.*`), a user-crafted malicious request could potentially bypass the validation rules.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-27515
reference_id
reference_type
scores
0
value 0.00284
scoring_system epss
scoring_elements 0.52061
published_at 2026-06-06T12:55:00Z
1
value 0.00284
scoring_system epss
scoring_elements 0.52052
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-27515
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27515
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27515
2
reference_url https://github.com/laravel/framework
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/laravel/framework
3
reference_url https://github.com/laravel/framework/commit/2d133034fefddfb047838f4caca3687a3ba811a5
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/laravel/framework/commit/2d133034fefddfb047838f4caca3687a3ba811a5
4
reference_url https://github.com/laravel/framework/commit/a4f7a8f9b83e21882abeef78c3174c66b0f4a26b
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/laravel/framework/commit/a4f7a8f9b83e21882abeef78c3174c66b0f4a26b
5
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1103881
reference_id 1103881
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1103881
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-27515
reference_id CVE-2025-27515
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-27515
7
reference_url https://github.com/advisories/GHSA-78fx-h6xr-vch4
reference_id GHSA-78fx-h6xr-vch4
reference_type
scores
url https://github.com/advisories/GHSA-78fx-h6xr-vch4
8
reference_url https://github.com/laravel/framework/security/advisories/GHSA-78fx-h6xr-vch4
reference_id GHSA-78fx-h6xr-vch4
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/laravel/framework/security/advisories/GHSA-78fx-h6xr-vch4
fixed_packages
0
url pkg:composer/laravel/framework@10.48.29
purl pkg:composer/laravel/framework@10.48.29
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/laravel/framework@10.48.29
1
url pkg:composer/laravel/framework@11.44.1
purl pkg:composer/laravel/framework@11.44.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/laravel/framework@11.44.1
2
url pkg:composer/laravel/framework@12.1.1
purl pkg:composer/laravel/framework@12.1.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/laravel/framework@12.1.1
aliases CVE-2025-27515, GHSA-78fx-h6xr-vch4
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-tzy8-b9et-fyd9
4
url VCID-xv5e-yt52-d7ae
vulnerability_id VCID-xv5e-yt52-d7ae
summary 
Unrestricted Upload of File with Dangerous Type
Laravel Framework does not sufficiently block the upload of executable PHP content because `Illuminate/Validation/Concerns/ValidatesAttributes.php` lacks a check for `.phar` files, which are handled as application/x-httpd-php on systems based on Debian. Note, this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2021-43617
reference_id
reference_type
scores
0
value 0.50135
scoring_system epss
scoring_elements 0.97879
published_at 2026-06-04T12:55:00Z
1
value 0.50135
scoring_system epss
scoring_elements 0.97884
published_at 2026-06-06T12:55:00Z
2
value 0.50135
scoring_system epss
scoring_elements 0.97883
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2021-43617
1
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43617
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43617
2
reference_url https://github.com/laravel/framework
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/laravel/framework
3
reference_url https://github.com/laravel/framework/blob/2049de73aa099a113a287587df4cc522c90961f5/src/Illuminate/Validation/Concerns/ValidatesAttributes.php#L1130-L1132
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/laravel/framework/blob/2049de73aa099a113a287587df4cc522c90961f5/src/Illuminate/Validation/Concerns/ValidatesAttributes.php#L1130-L1132
4
reference_url https://github.com/laravel/framework/blob/2049de73aa099a113a287587df4cc522c90961f5/src/Illuminate/Validation/Concerns/ValidatesAttributes.php#L1331-L1333
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/laravel/framework/blob/2049de73aa099a113a287587df4cc522c90961f5/src/Illuminate/Validation/Concerns/ValidatesAttributes.php#L1331-L1333
5
reference_url https://github.com/laravel/framework/pull/39666
reference_id
reference_type
scores
url https://github.com/laravel/framework/pull/39666
6
reference_url https://hosein-vita.medium.com/laravel-8-x-image-upload-bypass-zero-day-852bd806019b
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://hosein-vita.medium.com/laravel-8-x-image-upload-bypass-zero-day-852bd806019b
7
reference_url https://salsa.debian.org/php-team/php/-/blob/dc253886b5b2e9bc8d9e36db787abb083a667fd8/debian/php-cgi.conf#L5-6
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://salsa.debian.org/php-team/php/-/blob/dc253886b5b2e9bc8d9e36db787abb083a667fd8/debian/php-cgi.conf#L5-6
8
reference_url https://salsa.debian.org/php-team/php/-/commit/dc253886b5b2e9bc8d9e36db787abb083a667fd8
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://salsa.debian.org/php-team/php/-/commit/dc253886b5b2e9bc8d9e36db787abb083a667fd8
9
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1002728
reference_id 1002728
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1002728
10
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/50525.txt
reference_id CVE-2021-43617
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/50525.txt
11
reference_url https://nvd.nist.gov/vuln/detail/CVE-2021-43617
reference_id CVE-2021-43617
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2021-43617
12
reference_url https://github.com/advisories/GHSA-364w-9g92-3grq
reference_id GHSA-364w-9g92-3grq
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-364w-9g92-3grq
fixed_packages
0
url pkg:composer/laravel/framework@8.73.0
purl pkg:composer/laravel/framework@8.73.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6wn3-r4pw-a3a3
1
vulnerability VCID-fhw2-erwk-fqf4
2
vulnerability VCID-su5t-5e4w-fbc2
3
vulnerability VCID-tzy8-b9et-fyd9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/laravel/framework@8.73.0
1
url pkg:composer/laravel/framework@10.36.0
purl pkg:composer/laravel/framework@10.36.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fhw2-erwk-fqf4
1
vulnerability VCID-tzy8-b9et-fyd9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/laravel/framework@10.36.0
aliases CVE-2021-43617, GHSA-364w-9g92-3grq
risk_score 10.0
exploitability 2.0
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-xv5e-yt52-d7ae
Fixing_vulnerabilities
Risk_score10.0
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:composer/laravel/framework@8.70.1