File Validation Bypass in Laravel Framework - GHSA-78fx-h6xr-vch4
Summary
CVE-2025-27515: Laravel has a File Validation Bypass. Affects laravel/framework across 3 version ranges.
< 10.48.29
>= 11.0.0, < 11.44.1
>= 12.0.0, < 12.1.1
Fixed in 10.48.29, 11.44.1 or 12.1.1, depending on the release line you run. How to fix ↓
Also tracked for
- laravel · Bitnami
- php-laravel-framework · Debian:11
The same CVE-2025-27515 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Laravel is a popular PHP web application framework known for its elegant syntax and robust features, including routing, authentication, and file handling. It is widely used for building modern web applications. However, a recent vulnerability has been identified that affects its file validation mechanism, potentially allowing malicious users to bypass validation rules.
Vulnerability Detail
The vulnerability arises from the use of wildcard validation in Laravel, specifically when validating file or image field arrays (e.g., 'files.*'). A crafted malicious request can exploit this mechanism, leading to unauthorized file uploads or the execution of harmful files. This could result in severe consequences, including data breaches, server compromise, or the execution of arbitrary code, making it crucial for developers to address this issue promptly.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 10.48.2910.48.29composer require laravel/framework:10.48.29 -
>= 11.0.0, < 11.44.111.44.1composer require laravel/framework:11.44.1 -
>= 12.0.0, < 12.1.112.1.1composer require laravel/framework:12.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can implement stricter validation rules for file uploads by specifying the exact file types allowed instead of using wildcard validation. For example, instead of using 'files.*', specify 'files.image' for images or 'files.document' for documents.
Conclusion
The Laravel framework has a vulnerability that allows for file validation bypass, which can lead to serious security issues. It is essential to update to the latest patched versions to protect your application. Additionally, using Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for laravel/framework →
FAQ
The vulnerability allows attackers to bypass file validation rules in Laravel, potentially leading to unauthorized file uploads.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
Exploiting this vulnerability could lead to data breaches, server compromise, or execution of malicious code, posing significant risks to your application.
Yes, patches are available for Laravel versions 12.1.1 and 11.44.1. It is recommended to update to these versions.
If immediate updates are not possible, implement stricter validation rules as a temporary workaround to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for laravel/framework.
