EUVD-2025-21400
GHSA-jv7x-xhv2-p5v2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionGitHub Advisory
LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection (SSTI), which could potentially lead to Remote Code Execution (RCE) in vulnerable configurations. Attackers could execute arbitrary commands on the server, access sensitive environment variables, and/or escalate access depending on server configuration. Users are strongly advised to upgrade to version v2.8.1 or later to receive a patch.
AnalysisAI
LaRecipe versions prior to 2.8.1 contain a Server-Side Template Injection (SSTI) vulnerability that can lead to Remote Code Execution (RCE) in vulnerable configurations. The vulnerability allows unauthenticated network attackers to execute arbitrary commands on the server, access sensitive environment variables, and escalate privileges without requiring user interaction or special access. With a perfect CVSS 3.1 score of 10.0 and network-based attack vector, this represents a critical threat to all unpatched LaRecipe installations.
Technical ContextAI
LaRecipe is a Laravel-based documentation application that processes user-supplied Markdown input. The vulnerability stems from improper handling of template expressions in CWE-1336 (Insufficient Neutralization of Special Elements used in a Template Engine), where user-controlled input is passed directly to a template engine without adequate sanitization or escaping. Laravel applications commonly use Blade templating, which can execute arbitrary PHP code if untrusted input reaches the template rendering engine. The vulnerability affects the markdown processing pipeline where attacker-controlled content is not properly isolated before template compilation, allowing injection of template syntax (e.g., {{ }} or {!! !!} delimiters) that execute server-side code. This is particularly dangerous in Laravel environments where template engines have access to the full application context, including service containers and configuration objects.
RemediationAI
Immediate remediation steps: (1) UPGRADE: Update LaRecipe to version 2.8.1 or later immediately. This is the only official patch. Execute: composer update larecipe/larecipe to v2.8.1+; (2) VERIFY: After upgrade, test documentation rendering to ensure no functionality regression; (3) AUDIT: Review server logs (Laravel logs, web server access logs, PHP error logs) for evidence of exploitation attempts or successful attacks, looking for suspicious markdown inputs containing template syntax; (4) CREDENTIAL RESET: If the server was internet-facing during the vulnerable window, rotate all credentials (database passwords, API keys, environment secrets) as they may have been exposed; (5) INTERIM MITIGATIONS (if immediate patching is not possible): Disable LaRecipe routes via firewall/WAF rules, restrict network access to LaRecipe endpoints to trusted IPs only, implement Web Application Firewall (WAF) rules to detect and block template injection patterns in request payloads (e.g., block {{ and {!! patterns in Markdown input). NOTE: Workarounds are NOT reliable substitutes for patching—upgrade is mandatory. Vendor advisory: Check the official LaRecipe GitHub repository (larecipe/larecipe) releases page for patch notes and installation instructions.
Share
External POC / Exploit Code
Leaving vuln.today