Laravel Framework
CVE-2026-48019
HIGH
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
AC:H because exploitation requires the application to send mail to user-supplied addresses; S:C because the impact crosses into mail transport infrastructure beyond the Laravel process.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patched in versions 12.60.0 and 13.10.0.
AnalysisAI
CRLF injection in Laravel Framework (CWE-93) enables unauthenticated remote attackers to manipulate outbound email processing in any application that passes user-supplied email addresses to Laravel's mail functions. An attacker who can provide an email address to an application flow - such as registration, password reset, or contact forms - can embed carriage-return/line-feed sequences to inject additional SMTP headers, reroute messages to unintended recipients, or abuse the application's mail infrastructure as an open relay. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target Laravel application (1) accepts an email address as input from an unauthenticated user, and (2) uses that address as a recipient, sender, CC, or BCC parameter in a subsequent mail dispatch - for example, sending a registration confirmation, password-reset link, or contact-form acknowledgment to the address the user provided. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 8.9 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L) is defensible and internally consistent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Laravel Framework 12.60.0 or later (for 12.x installations) or 13.10.0 or later (for 13.x installations); tagged releases are available at https://github.com/laravel/framework/releases/tag/v12.60.0 and https://github.com/laravel/framework/releases/tag/v13.10.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all applications running Laravel Framework and document which systems pass user-supplied email addresses to mail functions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwo
Laravel Livewire v3 through v3.6.3 contains a critical remote code execution vulnerability (CVE-2025-54068, CVSS 9.8) th
LaRecipe versions prior to 2.8.1 contain a Server-Side Template Injection (SSTI) vulnerability that can lead to Remote C
File upload bypass in FreeScout 1.8.206 — patch bypass for CVE-2026-27636. PoC and patch available. CVSS 10.0.
Remote code execution in FreeScout prior to version 1.8.206 allows authenticated users to upload `.htaccess` files that
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unseri
Dokans SaaS e-commerce platform v3.9.2 has a CVSS 10.0 authentication bypass allowing unauthenticated attackers to obtai
Predictable password reset tokens in FreeScout help desk before 1.8.206. Weak random number generation allows attackers
Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address
Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauth
A vulnerability was found in laravel 5.1 and classified as problematic. Rated critical severity (CVSS 9.8), this vulnera
Bagisto eCommerce platform versions before 2.3.10 suffer from server-side template injection through user-controllable f
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today