GitHub Advisoryadvisory · Packagist

GHSA-78fx-h6xr-vch4 Laravel has a File Validation Bypass

MEDIUM Published 2025-03-05 Modified 2025-03-12 Official page ↗
Aliases
CVE-2025-27515
Ecosystem
Packagist
Packages
laravel/framework
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-155
Reviewed
2025-03-05

Affected packages

• Packagist laravel/framework: >= 12.0.0, < 12.1.1 → fixed in 12.1.1 • Packagist laravel/framework: >= 11.0.0, < 11.44.1 → fixed in 11.44.1 • Packagist laravel/framework: < 10.48.29 → fixed in 10.48.29

Description

When using wildcard validation to validate a given file or image field array (`files.*`), a user-crafted malicious request could potentially bypass the validation rules.

Related

Alias · CVE (1)

  • CVE-2025-27515 Laravel is a web application framework. vulnerability

Weakness · CWE (1)

  • CWE-155 Improper Neutralization of Wildcards or Matching Symbols weakness

References