p PatchFirst

CVE-2021-43617

CVE-2021-43617

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.

CVSS 9.8 · Critical · EPSS 19.8% · Public exploit · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • php-laravel-framework Debian:12

    Affected ranges
    • ECOSYSTEM: < 6.20.14+dfsg-3

    Update to 6.20.14+dfsg-3

  • php-laravel-framework Debian:13

    Affected ranges
    • ECOSYSTEM: < 6.20.14+dfsg-3

    Update to 6.20.14+dfsg-3

  • php-laravel-framework Debian:14

    Affected ranges
    • ECOSYSTEM: < 6.20.14+dfsg-3

    Update to 6.20.14+dfsg-3

Original sources

Check your server →