CVE-2025-54068Added 20 Mar 2026
Laravel Livewire Code Injection Vulnerability
Laravel Livewire contain a code injection vulnerability that could allow unauthenticated attackers to achieve remote command execution in specific scenarios.
CISA entry
← Search results
AUTOMATICALLY VERIFIEDOFFICIAL VENDOR SOURCECOLLECTED 12 SEP 2026
Laravel · AUTOMATIC DISCOVERY
Laravel 11
Laravel is tracked by BlackTree as a software framework or development platform. Its lifecycle page separates release identity, maintenance and security boundaries using the publisher's registered source.
This record passed BlackTree's automatic primary-source checks with a confidence score of 96. It is returned for operational research without requiring routine manual approval. Confirm edition and deployment applicability before acting.
Product overview
Laravel is tracked by BlackTree as a software framework or development platform. Its lifecycle page separates release identity, maintenance and security boundaries using the publisher's registered source.
Main capabilities
- Application development components
- Versioned runtime or build interfaces
- Security and compatibility maintenance
Typical use
Used by software teams to build, run or maintain applications.
Deployment
Included in source projects, application dependencies, build systems or managed runtimes.
This category-level context is generated from the registered product identity. Confirm exact product capabilities on the publisher's page .
Collected lifecycle data
| Product | Laravel |
|---|---|
| Release | 11 |
| End of Active support | 3 September 2025 |
| End of Support | 12 March 2026 |
| Date precision | Day |
Known exploited vulnerabilities
Catalogue updated 11 Sep 2026These are product-family matches in the CISA Known Exploited Vulnerabilities catalogue. Confirm the affected product version in the vendor advisory.
CVE-2018-15133Added 16 Jan 2024
Laravel Deserialization of Untrusted Data Vulnerability
Laravel Framework contains a deserialization of untrusted data vulnerability, allowing for remote command execution. This vulnerability may only be exploited if a malicious user has accessed the application encryption key (APP_KEY environment variable).
CISA entryCVE-2021-3129Added 18 Sep 2023
Laravel Ignition File Upload Vulnerability
Laravel Ignition contains a file upload vulnerability that allows unauthenticated remote attackers to execute malicious code due to insecure usage of file_get_contents() and file_put_contents().
CISA entryPackage vulnerability advisories
Checked 10 Sep 2026OSV advisories are matched through the registered package URL. A package-family match does not prove that the installed release is affected. Check the affected and fixed versions before remediation.
CVE-2026-48019High severity
Laravel Framework: CRLF injection in default email rule
OSV recordCVE-2021-21263High severity
Query Binding Exploitation
OSV recordCVE-2018-15133High severity
Laravel Framework RCE Vulnerability
OSV recordGHSA-crmm-hgp2-wgrpMedium severity
Laravel Framework: Temporary Signed URL Path Confusion
OSV recordCVE-2025-27515Medium severity
Laravel has a File Validation Bypass
OSV recordCVE-2021-43808Medium severity
Laravel Framework XSS in Blade templating engine
OSV recordCVE-2024-13919Medium severity
Laravel framework susceptible to reflected cross-site scripting
OSV recordCVE-2024-13918Medium severity
Laravel framework susceptible to reflected cross-site scripting
OSV recordSource evidence
PRIMARYManual
Laravel official lifecycle source
Version | PHP (*) | Release | Bug Fixes Until | Security Fixes Until | 11 | 8.2 - 8.4 | March 12th, 2024 | September 3rd, 2025 | March 12th, 2026
Publisher identity used by product-specific official-source collectors.
Open official vendor source