Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.2
Laravel Framework: Malicious URLs Can Bypass Expiration
published 4 months ago
Summary
Laravel's local filesystem driver has a bug that can cause malicious URLs to be interpreted incorrectly, allowing expired URLs to be used indefinitely and potentially leading to unintended writes to the wrong destination. This affects Laravel applications that use temporary signed URLs for file uploads. To mitigate this issue, update to the latest version of Laravel and ensure you are using secure practices for generating and handling temporary signed URLs.
What to do
- Update laravel framework to version 13.12.0.
- Update laravel framework to version 12.61.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | laravel | framework |
>= 13.0.0, < 13.12.0 < 12.61.1 Fix: upgrade to 13.12.0
|
Original advisory text
Laravel Framework: Temporary Signed URL Path Confusion
A vulnerability in Laravel's local filesystem driver allows temporary signed URLs to be parsed ambiguously, potentially misrouting requests and bypassing expiration enforcement.
Under certain conditions, a generated temporary signed URL can be interpreted differently by the server than intended at signing time. This may cause requests to resolve to an unintended resource, and can prevent expiration from being enforced, allowing expired URLs to remain valid indefinitely.
### Impact
- Expired temporary URLs may continue to be accepted
- Requests may resolve to a different resource than the one that was signed
- The upload variant may allow writes to reach an unintended destination
Under certain conditions, a generated temporary signed URL can be interpreted differently by the server than intended at signing time. This may cause requests to resolve to an unintended resource, and can prevent expiration from being enforced, allowing expired URLs to remain valid indefinitely.
### Impact
- Expired temporary URLs may continue to be accepted
- Requests may resolve to a different resource than the one that was signed
- The upload variant may allow writes to reach an unintended destination
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-116Improper Encoding or Escaping of Output
Timeline
Published17 Jun 2026
Updated17 Jun 2026
First seen17 Jun 2026
Sources
GHSA-crmm-hgp2-wgrp · GHSA
Track software like this
Free during beta