Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Laravel Framework allows malicious PHP file uploads

CVE-2021-43617 · published 4 years ago
Summary

A flaw in Laravel Framework allows attackers to upload and execute malicious PHP files on Debian-based systems, potentially leading to code execution. This could allow attackers to run unauthorized code on your server. You should update Laravel Framework to the latest version to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
composer laravel framework <= 8.70.2
Original advisory text
Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which...
Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.
References
Severity
9.8 Critical
Exploitation
20% chance of attack within 30 days
Type
CWE-434Unrestricted File Upload
Timeline
Published14 Nov 2021
Updated28 Oct 2026
First seen6 Mar 2026
Sources
GHSA-364w-9g92-3grq · GHSA
CVE-2021-43617 · NVD
Track software like this
Free during beta