Laravel security advisories

Supported framework branches

First-party packages

Packages the Laravel team maintains, each with its own page. Their advisories are listed below alongside the framework's.

All Laravel advisories

37 advisories, newest first.

• critical Laravel · Oct 23, 2026 · Reviewed Oct 31

  Laravel TokenGuard: Log In as Any User Without Their API Token

  Lets an unauthenticated attacker log in as another user in Laravel apps that use the token auth guard with MySQL or MariaDB.

  Fixed in 13.29.0 and 12.68.0

• medium Laravel · Oct 23, 2026 · Reviewed Oct 31

  Laravel: Relationship Includes on Read Endpoints Can Destroy Data

  Lets a user with only read access trigger a destructive query, such as emptying a related table, through relationship includes in some Laravel apps.

  Fixed in 13.27.0 and 12.68.0

• low Laravel · Sep 29, 2026 · Reviewed Nov 1

  Laravel Debug Page: Cross-Site Scripting When APP_DEBUG Is On

  Lets an attacker run script in a visitor's browser through the Laravel debug error page, when APP_DEBUG=true and the visitor hovers a tooltip.

  Fixed in 13.30.0 and 12.69.0

• medium Laravel · Jun 17, 2026 · Reviewed Nov 7

  Laravel Local Disk: Expired Temporary URLs Can Stay Valid

  Can let expired temporary signed URLs keep working, or point to a different file, in Laravel apps that serve the local disk with temporary URLs.

  Fixed in 13.12.0 and 12.61.1

• high Laravel · Jun 17, 2026 · Reviewed Nov 7

  Laravel Email Rule: Header Injection Into Outgoing Mail

  Lets an unauthenticated attacker interfere with outgoing email in Laravel apps that send mail to addresses users supply.

  Fixed in 12.60.0

• high Laravel · May 19, 2026 · Reviewed Oct 31

  Laravel Email Rule: Header Injection Into Outgoing Mail

  Lets an unauthenticated attacker interfere with outgoing email in Laravel apps that send mail to addresses users supply.

  Fixed in 13.10.0 and 12.60.0

• high Laravel Passport · Apr 8, 2026 · Reviewed Nov 7

  Laravel Passport: Client Credentials Tokens Can Authenticate as a Real User

  Can let a machine-to-machine token act as the user whose ID matches the client's ID, such as when Passport::$clientUuids is false.

  Fixed in 13.7.1

• critical Laravel Reverb · Jan 21, 2026 · Reviewed Nov 7

  Laravel Reverb: Remote Code Execution Through Redis When Scaling Is Enabled

  Allows remote code execution in Reverb apps with REVERB_SCALING_ENABLED=true by anyone who can publish to the Redis server Reverb uses.

  Fixed in 1.7.0

• medium Laravel · Mar 5, 2025 · Reviewed Nov 8

  Laravel Validation: Crafted Requests Can Bypass files.* Wildcard Rules

  Lets an attacker get files past validation in Laravel apps that validate arrays of files or images with wildcard rules like files.*.

  Fixed in 12.1.1 · 2 older releases

• high Laravel Pulse · Dec 13, 2024 · Reviewed Nov 8

  Laravel Pulse: Dashboard Users Can Run Code on the Server

  Lets a user who can open the Pulse dashboard call functions and static methods in the app, which can lead to running code on the server.

  Fixed in 1.3.1

• medium Laravel · Dec 13, 2024 · Reviewed Nov 8

  Laravel Debug Error Page: Request Parameters Allow Reflected XSS

  Lets an attacker run script in a visitor's browser through a crafted link to a Laravel app running with APP_DEBUG=true.

  Only affects branches that no longer get security fixes

• medium Laravel · Dec 13, 2024 · Reviewed Nov 9

  Laravel Debug Error Page: Route Parameters Can Run Injected JavaScript

  Lets a crafted link run JavaScript in a visitor's browser on Laravel 11 apps that show the debug error page with APP_DEBUG=true.

  Only affects branches that no longer get security fixes

• high Laravel · Nov 12, 2024 · Reviewed Nov 9

  Laravel Environment Detection: Query Strings Can Switch the App Environment

  Lets anyone change the environment Laravel uses for a request through the URL's query string, on servers where PHP's register_argc_argv is On.

  Only affects branches that no longer get security fixes

• high Laravel Reverb · Oct 31, 2024 · Reviewed Nov 9

  Laravel Reverb: Pusher API Requests Accepted Without Signature Checks

  Lets anyone who knows the app ID send events or read channel data through Reverb's Pusher-compatible HTTP API without a valid signature.

  Fixed in 1.4.0

• medium Laravel · May 15, 2024 · Reviewed Nov 10

  Laravel 4 Remember-Me Cookies Stay Valid After the User Logs Out

  Lets someone with a stolen remember-me cookie keep logging in as that user, even after the user logs out or resets their password.

  Only affects branches that no longer get security fixes

• medium Laravel · May 15, 2024 · Reviewed Nov 10

  Laravel 4 Eloquent: Models Using $guarded Open to Mass Assignment

  Can let users set model columns you meant to protect in Laravel 4 apps that use $guarded and pass request input to update or save.

  Only affects branches that no longer get security fixes

• critical Laravel · May 14, 2022

  Laravel Framework Deserialization Vulnerability

  Only affects branches that no longer get security fixes

• high Laravel · May 14, 2022

  Laravel Framework RCE Vulnerability

  No fixed release listed yet

• high Laravel Fortify · Feb 23, 2022

  Multi-Factor Authentication issue in Laravel Fortify

  Fixed in 1.11.1

• high Laravel · Jan 6, 2022

  OS Command Injection in Laravel Framework

  Only affects branches that no longer get security fixes

• unrated Laravel · Nov 18, 2021

  Image upload bypass

  Only affects branches that no longer get security fixes

• high Laravel · May 6, 2021

  Improper Input Validation in Laravel

  Only affects branches that no longer get security fixes

• medium Laravel · Apr 28, 2021

  SQL Server LIMIT / OFFSET SQL Injection

  Only affects branches that no longer get security fixes

• high Laravel · Jan 21, 2021

  Unexpected bindings in QueryBuilder

  Only affects branches that no longer get security fixes

• medium Laravel · Jan 1, 2021

  Possible cross-site scripting (XSS) vulnerability in the Blade templating engine

  Only affects branches that no longer get security fixes

• critical Laravel · Aug 6, 2020

  Guard bypass in Eloquent models

  Only affects branches that no longer get security fixes

• critical Laravel · Jul 27, 2020

  RCE vulnerability in "cookie" session driver

  Only affects branches that no longer get security fixes

• medium Laravel · Mar 13, 2020

  XSS vulnerability in blade templating

  Only affects branches that no longer get security fixes

• high Laravel · Jan 13, 2020

  Unexpected bindings in QueryBuilder

  Only affects branches that no longer get security fixes

• high Laravel · Aug 8, 2018

  Cookie serialization vulnerability

  Only affects branches that no longer get security fixes

• high Laravel · Mar 30, 2018

  Exploit of encryption failure vulnerability

  Only affects branches that no longer get security fixes

• medium Laravel · Sep 21, 2017

  Timing attack vector for remember me token

  Only affects branches that no longer get security fixes

• medium Laravel · May 7, 2017

  Password reset phishing vulnerability

  Only affects branches that no longer get security fixes

• medium Laravel Socialite · Aug 3, 2015

  State guessing vulnerability

  Fixed in 2.0.10 and 1.0.99

• medium Laravel Socialite · Jul 23, 2015

  Insecure state generation

  Fixed in 2.0.9 and 1.0.99

• high Laravel · May 20, 2014

  Risk of mass-assignment vulnerabilities

  Only affects branches that no longer get security fixes

• high Laravel · Apr 15, 2014

  Hijacked authentication cookies vulnerability

  Only affects branches that no longer get security fixes