PHP package security
Is laravel/framework vulnerable?
30 known security advisories for laravel/framework. The latest was reported on 2026-10-23 and is fixed in 12.68.0 and 13.29.0. The newest release, 13.40.0, is not affected by any of them.
3 critical 11 high 13 medium 1 low 2 unscored
- Known advisories
- 30
- Newest release
- 13.40.0
- Released
- 2026-11-03
- Affecting newest release
- 0
- Last synced
- 2026-11-03
Check your version
Security advisories for laravel/framework
| Reported | Advisory | Severity | Affected | Fixed in |
|---|---|---|---|---|
| 2026-10-23 | Laravel TokenGuard authentication bypass through non-string API credentials GHSA-f9x3-7vq9-cph6 · CVE-2026-114509 · GitHub | critical | <12.68.0 | >=13.0.0,<13.29.0 | 12.68.0, 13.29.0 |
| 2026-10-23 | Laravel relationship inclusion can trigger unauthorized data destruction GHSA-5wcm-3v2w-8362 · CVE-2026-114508 · GitHub | medium | >=13.0.0,<13.27.0 | >=12.45.0,<12.68.0 | 12.68.0, 13.27.0 |
| 2026-09-29 | Laravel: XSS in Debug Page Information GHSA-jh5r-qr3c-85q8 · CVE-2026-102279 · GitHub | low | >=13.0.0,<13.30.0 | <12.69.0 | 12.69.0, 13.30.0 |
| 2026-06-17 | Laravel Framework: Temporary Signed URL Path Confusion GHSA-crmm-hgp2-wgrp · GitHub | medium | <12.61.1 | >=13.0.0,<13.12.0 | 12.61.1, 13.12.0 |
| 2026-06-17 | Laravel Framework: CRLF injection in default email rule GHSA-5vg9-5847-vvmq · GitHub | high | <12.60.0 | >=13.0.0,<=13.9.0 | 12.60.0 |
| 2026-05-19 | Laravel CRLF injection in default email rule CVE-2026-48019 · FriendsOfPHP/security-advisories | unscored | >=9.0.0,<10.0.0 | >=10.0.0,<11.0.0 | >=11.0.0,<12.0.0 | >=12.0.0,<12.60.0 | >=13.0.0,<13.10.0 | 10.0.0, 11.0.0, 12.0.0, 12.60.0, 13.10.0 |
| 2025-03-05 | Laravel has a File Validation Bypass GHSA-78fx-h6xr-vch4 · CVE-2025-27515 · GitHub | medium | <10.48.29 | >=11.0.0,<11.44.1 | >=12.0.0,<12.1.1 | 10.48.29, 11.44.1, 12.1.1 |
| 2024-12-13 | Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page CVE-2024-13918 · GitHub, FriendsOfPHP/security-advisories | medium | >=11.9.0,<11.36.0 | 11.36.0 |
| 2024-12-13 | Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page CVE-2024-13919 · GitHub, FriendsOfPHP/security-advisories | medium | >=11.9.0,<11.36.0 | 11.36.0 |
| 2024-11-12 | Laravel environment manipulation via query string CVE-2024-52301 · GitHub, FriendsOfPHP/security-advisories | high | <6.20.45 | >=7.0.0,<7.30.7 | >=8.0.0,<8.83.28 | >=9.0.0,<9.52.17 | >=10.0.0,<10.48.23 | >=11.0.0,<11.31.0 | 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, 11.31.0 |
| 2024-05-15 | Laravel Hijacked authentication cookies vulnerability GHSA-p62r-7637-3wwc · GitHub | medium | >=4.0.0,<4.1.26 | 4.1.26 |
| 2024-05-15 | Laravel Risk of mass-assignment vulnerabilities GHSA-rj3w-99gc-8j58 · GitHub | medium | >=4.0.0,<4.1.29 | 4.1.29 |
| 2022-05-14 | Laravel Framework Deserialization Vulnerability GHSA-pfg4-p438-p874 · CVE-2019-9081 · GitHub | critical | >=5.7.0,<6.20.44 | 6.20.44 |
| 2022-05-14 | Laravel Framework RCE Vulnerability GHSA-qvqm-h22r-4cp9 · CVE-2018-15133 · GitHub | high | >=5.6.0,<=5.6.29 | <=5.5.40 | not stated |
| 2022-01-06 | OS Command Injection in Laravel Framework GHSA-w2pm-r78h-4m7v · CVE-2020-19316 · GitHub | high | <5.8.17 | 5.8.17 |
| 2021-11-18 | Image upload bypass CVE-2021-43617 · FriendsOfPHP/security-advisories | unscored | >=8.0.0,<8.71.0 | 8.71.0 |
| 2021-05-06 | Improper Input Validation in Laravel GHSA-w68r-5p45-5rqp · CVE-2020-24941 · GitHub | high | >=7.0.0,<7.24.0 | <6.18.35 | 6.18.35, 7.24.0 |
| 2021-04-28 | SQL Server LIMIT / OFFSET SQL Injection Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=6.0.0,<6.20.26 | >=7.0.0,<7.30.5 | >=8.0.0,<8.40.0 | 6.20.26, 7.30.5, 8.40.0 |
| 2021-01-21 | Unexpected bindings in QueryBuilder Advisory · GitHub, FriendsOfPHP/security-advisories | high | >=6.0.0,<6.20.14 | >=7.0.0,<7.30.4 | >=8.0.0,<8.24.0 | 6.20.14, 7.30.4, 8.24.0 |
| 2021-01-01 | Possible cross-site scripting (XSS) vulnerability in the Blade templating engine CVE-2021-43808 · GitHub, FriendsOfPHP/security-advisories | medium | <6.20.42 | >=7.0.0,<7.30.6 | >=8.0.0,<8.75.0 | 6.20.42, 7.30.6, 8.75.0 |
| 2020-08-06 | Guard bypass in Eloquent models Advisory · GitHub, FriendsOfPHP/security-advisories | critical | >=5.5.0,<=5.5.49 | >=6.0.0,<6.18.34 | >=7.0.0,<7.23.2 | 6.18.34, 7.23.2 |
| 2020-07-27 | RCE vulnerability in "cookie" session driver Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=4.1.0,<=4.1.99999 | >=4.2.0,<=4.2.99999 | >=5.0.0,<=5.0.99999 | >=5.1.0,<=5.1.99999 | >=5.2.0,<=5.2.99999 | >=5.3.0,<=5.3.99999 | >=5.4.0,<=5.4.99999 | >=5.5.0,<=5.5.49 | >=5.6.0,<=5.6.99999 | >=5.7.0,<=5.7.99999 | >=5.8.0,<=5.8.99999 | >=6.0.0,<6.18.31 | >=7.0.0,<7.22.4 | 6.18.31, 7.22.4 |
| 2020-03-13 | XSS vulnerability in blade templating Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=7.0.0,<7.1.2 | 7.1.2 |
| 2020-01-13 | Unexpected bindings in QueryBuilder CVE-2021-21263 · GitHub, FriendsOfPHP/security-advisories | high | >=6.0.0,<6.20.11 | >=7.0.0,<7.30.2 | >=8.0.0,<8.22.1 | 6.20.11, 7.30.2, 8.22.1 |
| 2018-08-08 | Cookie serialization vulnerability Advisory · GitHub, FriendsOfPHP/security-advisories | high | >=4.0.0,<=4.0.11 | >=4.1.0,<=4.1.31 | >=4.2.0,<=4.2.22 | >=5.0.0,<=5.0.35 | >=5.1.0,<=5.1.46 | >=5.2.0,<=5.2.45 | >=5.3.0,<=5.3.31 | >=5.4.0,<=5.4.36 | >=5.5.0,<5.5.42 | >=5.6.0,<5.6.30 | 5.5.42, 5.6.30 |
| 2018-03-30 | Exploit of encryption failure vulnerability Advisory · GitHub, FriendsOfPHP/security-advisories | high | >=4.0.0,<=4.0.11 | >=4.1.0,<=4.1.31 | >=4.2.0,<=4.2.22 | >=5.0.0,<=5.0.35 | >=5.1.0,<=5.1.46 | >=5.2.0,<=5.2.45 | >=5.3.0,<=5.3.31 | >=5.4.0,<=5.4.36 | >=5.5.0,<5.5.40 | >=5.6.0,<5.6.15 | 5.5.40, 5.6.15 |
| 2017-09-21 | Timing attack vector for remember me token CVE-2017-14775 · GitHub, FriendsOfPHP/security-advisories | medium | >=4.1.26,<=4.1.31 | >=4.2.0,<=4.2.22 | >=5.0.0,<=5.0.35 | >=5.1.0,<=5.1.46 | >=5.2.0,<=5.2.45 | >=5.3.0,<=5.3.31 | >=5.4.0,<=5.4.36 | >=5.5.0,<5.5.10 | 5.5.10 |
| 2017-05-07 | Password reset phishing vulnerability CVE-2017-9303 · GitHub, FriendsOfPHP/security-advisories | medium | >=5.3.0,<=5.3.31 | >=5.4.0,<5.4.22 | 5.4.22 |
| 2014-05-20 | Risk of mass-assignment vulnerabilities Advisory · GitHub, FriendsOfPHP/security-advisories | high | >=4.0.0,<4.0.99 | >=4.1.0,<4.1.29 | 4.0.99, 4.1.29 |
| 2014-04-15 | Hijacked authentication cookies vulnerability Advisory · GitHub, FriendsOfPHP/security-advisories | high | >=4.0.0,<4.0.99 | >=4.1.0,<4.1.26 | 4.0.99, 4.1.26 |
Need help patching or upgrading? Laskyr does PHP and Laravel security fixes and upgrades. Tell us what you run and we reply with a plan and a price.
Ask about a fixCheck your whole project. Paste your composer.lock and see every installed package with a known advisory. Nothing is stored.
Check composer.lockQuestions about laravel/framework
Does laravel/framework have known vulnerabilities?
Yes. Packagist lists 30 security advisories for laravel/framework (3 critical, 11 high, 13 medium, 1 low severity). The most recent, reported 2026-10-23, is "Laravel TokenGuard authentication bypass through non-string API credentials". The newest release, 13.40.0, is outside every affected range.
Which version of laravel/framework should I run?
The newest stable release is 13.40.0 (published 2026-11-03). The most recent advisory is fixed in 12.68.0 and 13.29.0, so stay on or above the fixed version for your major version. Run composer update laravel/framework, then composer audit to confirm nothing else is flagged.
How do I check if my laravel/framework version is affected?
Run composer show laravel/framework in your project to see the installed version, then enter it in the version check on this page. You can also run composer audit, which reads the same Packagist advisory data for every package in your composer.lock.