Skip to content
Threat Feed
Subscribe

Vendor

Laravel

6 briefs RSS
high advisory

Server-Side Request Forgery in Laravel-Mediable Allows Credential Exfiltration

A Server-Side Request Forgery (SSRF) vulnerability, CVE-2026-49969, exists in Laravel-Mediable versions prior to 7.0.0, allowing remote attackers to force the server to make arbitrary HTTP requests to attacker-controlled URLs provided to `MediaUploader::fromSource()` to target internal network resources, access sensitive files, and exfiltrate cloud credentials like IAM tokens.

Laravel-Mediable ssrf vulnerability web-application credential-access data-exfiltration
4r 4t 1c
medium advisory

Laravel Security Policy Bypass Vulnerability

A vulnerability in Laravel allows an attacker to bypass the security policy; specifically, laravel/framework versions 12.x before 12.60.0 and 13.x before 13.10.0 are affected (CVE-2026-48019).

laravel/framework security-bypass web-application laravel
1r 1t
high advisory

Laravel Lang Packages Hijacked in Credential-Stealing Supply Chain Attack

Attackers compromised Laravel Lang packages by rewriting GitHub tags, distributing a credential-stealing malware targeting cloud credentials, secrets, keys, browser data, and cryptocurrency wallets across Windows, Linux, and macOS systems.

laravel-lang/lang +3 supply-chain-attack credential-theft infostealer composer php github
2r 4t 1i
high advisory

Authenticated Sharp Users Can Download Unrelated Laravel Storage Objects

An authenticated Sharp user with view access to at least one valid Sharp entity instance can download unrelated files from configured Laravel Storage disks by manipulating the `disk` and `path` parameters in the generic download endpoint, potentially exposing sensitive data like backups and internal documents; this vulnerability is tracked as CVE-2026-44692.

composer/code16/sharp +1 authenticated-disclosure web-application laravel sharp
2r 1t
high advisory

webonyx/graphql-php Unbounded Recursion Vulnerability

The webonyx/graphql-php library has an unbounded recursion vulnerability in its parser that can lead to a stack overflow, causing a denial of service by terminating the PHP process with a SIGSEGV.

graphql-php +4 graphql denial-of-service recursion php
2r 1t
high advisory

Laravel Passport Authentication Bypass via Client Credentials Tokens

Laravel Passport before v13.7.1 allows an authentication bypass via client credentials tokens, where a client's identifier can be used to impersonate a user if `Passport::$clientUuids` is set to false or the EnsureClientIsResourceOwner middleware is in use.

Laravel Passport laravel passport oauth2 authentication-bypass
2r 1t