Security advisoryGHSA-crmm-hgp2-wgrp

Laravel Framework: Temporary Signed URL Path Confusion

A vulnerability in Laravel's local filesystem driver allows temporary signed URLs to be parsed ambiguously, potentially misrouting requests and bypassing expiration enforcement. Under certain conditions, a generated temporary signed URL can be interpreted differently by the server than intended at signing time. This m…

Moderate4.2Published Jun 17, 2026Modified Sep 10, 2026Original advisory

As published by the sources

Affected packages

laravel/framework
Affected>=13.0.0,<13.12.0 || <12.61.1
Fixed in12.61.113.12.0

Derived from the fixed versions above

What to do

1
Upgrade laravel/framework to the fixed version in your release line: 12.61.1, 13.12.0.
```
composer update laravel/framework --with-dependencies
```

To see which version you have installed, run composer show vendor/package. Running composer audit lists the known advisories that match your installed versions.

Quoted from the original advisory

Details

A vulnerability in Laravel's local filesystem driver allows temporary signed URLs to be parsed ambiguously, potentially misrouting requests and bypassing expiration enforcement.

Under certain conditions, a generated temporary signed URL can be interpreted differently by the server than intended at signing time. This may cause requests to resolve to an unintended resource, and can prevent expiration from being enforced, allowing expired URLs to remain valid indefinitely.

Impact

Expired temporary URLs may continue to be accepted
Requests may resolve to a different resource than the one that was signed
The upload variant may allow writes to reach an unintended destination