Laravel Framework up to 11.44.0/12.1.0 matching

Summaryinfo

A vulnerability described as critical has been identified in Laravel Framework up to 11.44.0/12.1.0. Affected by this vulnerability is an unknown functionality. The manipulation results in matching. This vulnerability is identified as CVE-2025-27515. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Laravel Framework up to 11.44.0/12.1.0. It has been classified as critical. Affected is an unknown code block. The manipulation with an unknown input leads to a matching vulnerability. CWE is classifying the issue as CWE-155. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as wildcards or matching symbols when they are sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2025-27515 since 02/26/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 232181 (Linux Distros Unpatched Vulnerability : CVE-2025-27515), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 11.44.1 or 12.1.1 eliminates this vulnerability. Applying the patch 2d133034fefddfb047838f4caca3687a3ba811a5 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (232181). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Laravel

Name

• Framework

Version

• 11.0
• 11.1
• 11.2
• 11.3
• 11.4
• 11.5
• 11.6
• 11.7
• 11.8
• 11.9
• 11.10
• 11.11
• 11.12
• 11.13
• 11.14
• 11.15
• 11.16
• 11.17
• 11.18
• 11.19
• 11.20
• 11.21
• 11.22
• 11.23
• 11.24
• 11.25
• 11.26
• 11.27
• 11.28
• 11.29
• 11.30
• 11.31
• 11.32
• 11.33
• 11.34
• 11.35
• 11.36
• 11.37
• 11.38
• 11.39
• 11.40
• 11.41
• 11.42
• 11.43
• 11.44.0
• 12.0
• 12.1.0

License

• open-source

Website

• Product: https://github.com/laravel/framework/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion