Laravel Environment Detection: Query Strings Can Switch the App Environment

Published as "Laravel environment manipulation via query string"

high Laravel Laravel framework · Last reviewed Nov 9, 2026

CVE: CVE-2024-52301
GHSA: GHSA-gv7v-rgg6-548h
Packagist: PKSA-w7xr-vk7n-rstm
Reported: Nov 12, 2024

Lets anyone change the environment Laravel uses for a request through the URL's query string, on servers where PHP's register_argc_argv is On.

Affected and fixed versions

In laravel/framework. Find the row for the version you run, and update to the release next to it.

If you run	Update to	Support
11.0.0 – 11.30.x	11.31.0
10.0.0 – 10.48.22	10.48.23
9.0.0 – 9.52.16	9.52.17

Show 3 older branches

8.0.0 – 8.83.27	8.83.28
7.0.0 – 7.30.6	7.30.7
Up to 6.20.44	6.20.45

Upgrade

Run the line for the branch you are on.

composer require laravel/framework:^11.31.0
composer require laravel/framework:^10.48.23
composer require laravel/framework:^9.52.17

What this means

On some servers, a visitor could change the environment Laravel uses for a request by adding a crafted query string to a URL. Laravel checked command-line arguments when it detected the environment, and with PHP's register_argc_argv setting on, a web request's query string ends up in those arguments.

Who is affected

Apps where the register_argc_argv ini setting is On for the PHP that serves web requests (PHP-FPM, mod_php and so on). Check it in a web request with ini_get('register_argc_argv'), not on the command line. If it's Off, you're not exposed. What an attacker gains depends on what your app does differently per environment, such as code behind App::environment() checks.

Affected releases of laravel/framework are below 6.20.45, 7.x below 7.30.7, 8.x below 8.83.28, 9.x below 9.52.17, 10.x below 10.48.23, and 11.x below 11.31.0.

What to do

Update to the fixed release for your branch: 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23 or 11.31.0. After the fix, Laravel ignores argv values for environment detection outside the command line. See Laravel's advisory.

Check your app with an agent

Paste this into a coding agent that can read your project, such as Claude Code, Codex or Amp. It checks your composer.lock against the versions above and tells you what to update, without changing anything.

Check whether the PHP project you have access to is affected by this security advisory, and tell me what to update. Do a read-only check: don't edit files, don't run composer update or composer require, and don't try to reproduce the flaw.

Advisory: Laravel Environment Detection: Query Strings Can Switch the App Environment (CVE-2024-52301, GHSA-gv7v-rgg6-548h)
Details: https://phpnews.net/security/laravel/ghsa-gv7v-rgg6-548h

Affected versions, as Composer constraints:
- laravel/framework: <6.20.45|>=7.0.0,<7.30.7|>=8.0.0,<8.83.28|>=9.0.0,<9.52.17|>=10.0.0,<10.48.23|>=11.0.0,<11.31.0

Fixed releases:
- 11.0.0 – 11.30.x: update to 11.31.0
- 10.0.0 – 10.48.22: update to 10.48.23
- 9.0.0 – 9.52.16: update to 9.52.17

1. Find every composer.lock in the project outside vendor/ (a monorepo can have one per app) and read the installed version of each package above. Packages installed as dependencies of other packages count too.
2. Compare each installed version with its constraint: "|" separates alternative ranges, and "," means both bounds apply.
3. For each affected install, read "What this means" at https://phpnews.net/security/laravel/ghsa-gv7v-rgg6-548h and check whether the project meets the conditions it describes (a feature in use, a config value, a driver). Say which conditions you could check and which you couldn't.
4. Report a table: lock file | package | installed version | affected (yes, no or unknown) | conditions met (yes, no or unknown) | update to | evidence. For each affected package, give the command that would fix it, without running it: composer update <package> --with-dependencies when it is only installed as a dependency of another package, or composer require with the fixed version when composer.json requires it directly. If the installed version is on a branch with no fixed release listed, say it needs a move to a newer branch.

Sources

← All Laravel advisories