framework
v13.42.0Laravel is a web application framework with expressive, elegant syntax.
- Maintenance
- Active632 commits in 3 months · bus factor 1
- License
- MITPermissive · OSI-approved
- Security
- 14 advisories1 critical, 5 high, 6 medium, 2 low · Scorecard 6.3/10
- Supported versions
- No scheduleendoflife.date does not track this project
35k stars · 12k forks · 96 open issues · last release 4 days ago · data checked 3 hours ago
Security advisories
All advisories on GitHubThe 14 most recent advisories published by the maintainers: 1 critical, 5 high, 6 medium, 2 low. Check the patched version against the one you run.
- mediumGHSA-v5ch-g375-82r6Nov 11, 2026Temporary signed URL expiration bypass
- Affected
- < 12.72.0; >= 13.0.0, < 13.41.0
- Patched in
- 12.72.0; 13.41.0
- mediumGHSA-6rv8-qj5v-p8chNov 11, 2026Temporary signed URL expiration bypass via unencoded numeric-keyed route parameters
- Affected
- < 12.72.0; >= 13.0.0, < 13.41.0
- Patched in
- 12.72.0; 13.41.0
- lowCVE-2026-128083Nov 4, 2026Task Output Injection - Concurrency Process
- Affected
- <v13.40.0
- Patched in
- >=v13.40.0
- mediumCVE-2026-114508Oct 19, 2026Unauthorized Data Destruction
- Affected
- >= 12.45.0; < 13.27.0
- Patched in
- >= 12.68.0; >= 13.27.0
- criticalCVE-2026-114509Oct 19, 2026Token-based API guard Auth Bypass
- Affected
- < 13.29.0; < v12.68.0
- Patched in
- >= 13.29.0; >= v12.68.0
- lowCVE-2026-102279Sep 10, 2026XSS in Debug Page Information
- Affected
- <v12.69.0; <v13.30.0
- Patched in
- >=v12.69.0; >=v13.30.0
- mediumCVE-2026-48041Jun 8, 2026Temporary Signed URL Path Confusion
- Affected
- <13.12.0; <12.61.1
- Patched in
- >=13.12.0; >=12.61.1
- highCVE-2026-48019Jun 1, 2026CRLF injection in default email rule
- Affected
- <= 13.9.0; < 12.60.0
- Patched in
- >= 13.10.0; >= 12.60.0
- mediumCVE-2025-27515Mar 5, 2025File Validation Bypass
- Affected
- <11.44.1,>=12,<12.1.1
- Patched in
- 12.1.1,11.44.1
- highCVE-2024-52301Nov 12, 2024Environment manipulation via query string
- Affected
- <6.20.45,>=7,<7.30.7,>=8,<8.83.28,>=9,<9.52.17,>=10,<10.48.23,>=11,<11.31.0
- Patched in
- 6.20.45,7.30.7,8.83.28,9.52.17,10.48.23,11.31.0
- mediumCVE-2021-43808Dec 7, 2021Blade `@parent` Exploitation Leading To Possible XSS
- Affected
- >=8.0.0, <8.75.0, >=7.0.0, <7.30.6, <6.20.42
- Patched in
- 6.20.42, 7.30.6, 8.75.0
- highGHSA-4mg9-vhxq-vm7jApr 28, 2021SQL Server LIMIT / OFFSET SQL Injection
- Affected
- >=8.0.0, <8.40.0, >=7.0.0, <7.30.5, <6.20.26
- Patched in
- 6.20.26, 7.30.5, 8.40.0
- highFeb 2, 2021Unexpected database bindings via requests (follow-up)
- Affected
- >=8.0.0, <8.24.0, >=7.0.0, <7.30.4, <6.20.14
- Patched in
- 6.20.14, 7.30.4, 8.24.0
- highCVE-2021-21263Jan 15, 2021Query Binding Exploitation
- Affected
- >=8.0.0, <8.22.1, >=7.0.0, <7.30.3, <6.20.12