EUVD-2025-21400
GHSA-jv7x-xhv2-p5v2
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
4Description
LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection (SSTI), which could potentially lead to Remote Code Execution (RCE) in vulnerable configurations. Attackers could execute arbitrary commands on the server, access sensitive environment variables, and/or escalate access depending on server configuration. Users are strongly advised to upgrade to version v2.8.1 or later to receive a patch.
Analysis
LaRecipe versions prior to 2.8.1 contain a Server-Side Template Injection (SSTI) vulnerability that can lead to Remote Code Execution (RCE) in vulnerable configurations. The vulnerability allows unauthenticated network attackers to execute arbitrary commands on the server, access sensitive environment variables, and escalate privileges without requiring user interaction or special access. With a perfect CVSS 3.1 score of 10.0 and network-based attack vector, this represents a critical threat to all unpatched LaRecipe installations.
Technical Context
LaRecipe is a Laravel-based documentation application that processes user-supplied Markdown input. The vulnerability stems from improper handling of template expressions in CWE-1336 (Insufficient Neutralization of Special Elements used in a Template Engine), where user-controlled input is passed directly to a template engine without adequate sanitization or escaping. Laravel applications commonly use Blade templating, which can execute arbitrary PHP code if untrusted input reaches the template rendering engine. The vulnerability affects the markdown processing pipeline where attacker-controlled content is not properly isolated before template compilation, allowing injection of template syntax (e.g., {{ }} or {!! !!} delimiters) that execute server-side code. This is particularly dangerous in Laravel environments where template engines have access to the full application context, including service containers and configuration objects.
Affected Products
LaRecipe versions prior to 2.8.1 are vulnerable. Specific affected versions include all releases before 2.8.1 (e.g., 2.8.0, 2.7.x, 2.6.x, and earlier). The product is distributed as a Laravel package and is affected across all supported Laravel framework versions where LaRecipe is installed as a dependency. Affected deployments include: (1) LaRecipe standalone documentation sites; (2) Laravel applications with LaRecipe integrated as a package; (3) Self-hosted documentation portals using LaRecipe. The vulnerability affects all operating systems (Linux, Windows, macOS) where PHP/Laravel runs, and impacts both development and production environments if accessible over the network. CPE representation would be: cpe:2.7:a:larecipe:larecipe:*:*:*:*:*:*:*:* (versions before 2.8.1). Patch availability: Version 2.8.1 and later contain the security fix.
Remediation
Immediate remediation steps: (1) UPGRADE: Update LaRecipe to version 2.8.1 or later immediately. This is the only official patch. Execute: composer update larecipe/larecipe to v2.8.1+; (2) VERIFY: After upgrade, test documentation rendering to ensure no functionality regression; (3) AUDIT: Review server logs (Laravel logs, web server access logs, PHP error logs) for evidence of exploitation attempts or successful attacks, looking for suspicious markdown inputs containing template syntax; (4) CREDENTIAL RESET: If the server was internet-facing during the vulnerable window, rotate all credentials (database passwords, API keys, environment secrets) as they may have been exposed; (5) INTERIM MITIGATIONS (if immediate patching is not possible): Disable LaRecipe routes via firewall/WAF rules, restrict network access to LaRecipe endpoints to trusted IPs only, implement Web Application Firewall (WAF) rules to detect and block template injection patterns in request payloads (e.g., block {{ and {!! patterns in Markdown input). NOTE: Workarounds are NOT reliable substitutes for patching—upgrade is mandatory. Vendor advisory: Check the official LaRecipe GitHub repository (larecipe/larecipe) releases page for patch notes and installation instructions.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today