Laravel Voyager CVE-2020-37214

Requires a deployed instance of Voyager 1.3.0 (the-control-group/voyager Laravel admin package) with the /admin/voyager-assets asset-serving endpoint reachable by the attacker. Per the CVSS vector exploitation is remote and unauthenticated (PR:N, UI:N, AC:L) with no special configuration needed beyond the vulnerable version being present and the voyager-assets route being network-accessible. Limiting factors: impact is read-only file disclosure (no write/RCE directly), and value depends on sensitive files being readable by the web-server user (e.g., Laravel .env typically is). Defenders should verify whether their deployment places the voyager-assets route behind authentication, since the '/admin' path prefix may differ from the stated unauthenticated reachability.

This is a credible, actionable issue despite not reaching emergency status. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, unauthenticated, low-complexity attack with no user interaction, and the impact is confidentiality-only (VC:H, VI:N, VA:N) - consistent with a path-traversal arbitrary-file-read. The EPSS score of 0.30% (53rd percentile) is modest, indicating no sign of broad automated mass-exploitation, but this understates practical risk because a public exploit DOES exist (Exploit-DB 47875) AND a ProjectDiscovery nuclei template (voyager-lfi.yaml) exists, meaning the flaw is trivially scannable at scale by opportunistic actors. It is NOT in CISA KEV, so there is no confirmation of active in-the-wild exploitation. Net: moderate CVSS (8.7) that is a genuine priority wherever Voyager 1.3.0 is internet-exposed, because the combination of unauthenticated access and turnkey tooling lowers the bar considerably; the main thing capping real-world severity is the limited (read-only) impact and the moderate deployment footprint of the product. One nuance to verify: the vulnerable route is /admin/voyager-assets, whose '/admin' prefix might suggest an authenticated area, yet the CVSS vector asserts PR:N (unauthenticated) - this is consistent with Voyager serving static assets through an unauthenticated route, but operators should confirm their deployment does not gate this route behind auth.

A remote attacker with no credentials sends a GET request to /admin/voyager-assets with a traversal sequence in the 'path' parameter (e.g. ../../../../etc/passwd or ../../.env) and the application returns the file contents. Reading the Laravel .env file discloses APP_KEY, database credentials, and API secrets, enabling follow-on compromise. A public exploit (Exploit-DB 47875) and a nuclei detection template exist, making this point-and-shoot against exposed instances.