Skip to content
laravel.now

Security advisories

Advisories affecting Composer packages, taken from public advisory databases. Each entry lists the affected version ranges and fixed versions exactly as published, and links to the original source.

Subscribe via RSS

AllCriticalHighModerateLowNot provided
  6. High7.6CVE-2026-55409

    Filament: Disabled RichEditor field state can be used for XSS

    In Filament v3, a disabled RichEditor field rendered its raw state without sanitizing HTML. Where the data stored in this field's state isn't sanitized already when the form state was filled, an attacker could plant malicious HTML or JavaScript and achieve XSS that executes for users who view the form. Please note tha…

    • filament/forms

      Affected
      >=3.0.0, <=3.3.52
      Fixed in
      3.3.53

    Original advisory (GitHub Advisory Database)

  10. High7.5CVE-2024-47823

    Livewire Remote Code Execution on File Uploads

    In livewire/livewire prior to v2.12.7 and v3.5.2, the file extension of an uploaded file is guessed based on the MIME type. As a result, the actual file extension from the file name is not validated. An attacker can therefore bypass the validation by uploading a file with a valid MIME type (e.g., image/png) and a “.ph…

    • livewire/livewire

      Affected
      >=3.0.0-beta.1, <3.5.2<2.12.7
      Fixed in
      2.12.73.5.2

    Original advisory (Packagist security advisories)

  12. High7.2GHSA-x7p5-p2c9-phvg

    Unexpected database bindings

    This is a follow-up to the previous security advisory (GHSA-3p32-j457-pg5x) which addresses a few additional edge cases. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpe…

    • laravel/framework

      Affected
      <6.20.14>=7.0.0, <7.30.4>=8.0.0, <8.24.0
      Fixed in
      6.20.147.30.48.24.0

    • illuminate/database

      Affected
      <6.20.14>=7.0.0, <7.30.4>=8.0.0, <8.24.0
      Fixed in
      6.20.147.30.48.24.0

    Original advisory (Packagist security advisories)

  14. HighGHSA-jwvj-pwww-3mj5

    laravel framework Unexpected database bindings via requests

    This is a follow-up to the security advisory https://github.com/laravel/framework/security/advisories/GHSA-3p32-j457-pg5x which addresses a few additional edge cases. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type befor…

    • laravel/framework

      Affected
      >=6.0.0, <6.20.14>=7.0.0, <7.30.4>=8.0.0, <8.24.0
      Fixed in
      6.20.147.30.48.24.0

    Original advisory (Packagist security advisories)

  16. HighGHSA-6jvx-8ch9-j2jr

    Laravel Cookie serialization vulnerability

    Laravel 5.6.30 is a security release of Laravel and is recommended as an immediate upgrade for all users. Laravel 5.6.30 also contains a breaking change to cookie encryption and serialization logic. Refer to laravel advisory for more details and read the notes carefully when upgrading your application.

    • laravel/framework

      Affected
      >=5.5.0, <5.6.30
      Fixed in
      5.6.30

    Original advisory (Packagist security advisories)

  19. High8.1CVE-2018-15133

    Laravel Framework RCE Vulnerability

    In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpgg…

    • laravel/framework

      Affected
      <=5.5.40>=5.6.0, <5.6.30
      Fixed in
      5.6.30

    Original advisory (Packagist security advisories)

laravel.now

The PHP and Laravel ecosystem, live.

laravel.now is an independent community project. It is not affiliated with, endorsed by, sponsored by, or in any way officially connected to Laravel, Laravel LLC, Taylor Otwell, or the Laravel framework maintainers. Laravel is a trademark of Taylor Otwell. All other trademarks belong to their respective owners.

This site is operated by the makers of Lockhound. Links to Lockhound are promotional.