TI-2018-10827 Aliases CVE-2018-15133 GHSA-qvqm-h22r-4cp9

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might…

CRITICAL 94Exploited in the wildCWE-502Published 2018-08-09 · Updated 2025-10-21

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.

Why it matters now

Exploitation Active In CISA KEV since 2024-01-16CISA due date 2024-02-06

EPSS 0.7657 99th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed laravel/framework (Packagist): 5.6.30

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Active
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	laravel/framework (Packagist)	up to 5.5.40	—	No fix listed	GHSA-qvqm-h22r-4cp9
—	laravel/framework (Packagist)	5.6.0 to before 5.6.30	5.6.30	Patch available	GHSA-qvqm-h22r-4cp9

— Vendor— Affected all versions Fixed in — No fix listed CNA
laravel/framework (Packagist) Vendor— Affected up to 5.5.40 Fixed in — No fix listed GHSA-qvqm-h22r-4cp9
laravel/framework (Packagist) Vendor— Affected 5.6.0 to before 5.6.30 Fixed in 5.6.30 Patch available GHSA-qvqm-h22r-4cp9

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:laravel:laravel::::::::	up to 5.5.40; 5.6.0 – 5.6.29	Vulnerable	Laravel

cpe:2.3:a:laravel:laravel:*:*:*:*:*:*:*:* Versions up to 5.5.40; 5.6.0 – 5.6.29 Vulnerable ·Laravel

Remediation

Fix · GHSA-qvqm-h22r-4cp9 laravel/framework (Packagist) Fixed in 5.6.30 Advisory →

Timeline

2024-01-16 Added to CISA KEV
2026-10-02 Threatist record created from CVE-2018-15133
2026-10-03 Alias added: GHSA-qvqm-h22r-4cp9

References

Exploit 1

http://packetstormsecurity.com/files/153641/PHP-Laravel-Framework-Token-Unserialize-Remote-Command-Execution.html

Advisory 2

Other 3

TI-2021-09454 A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows… CVSS 3.1CRITICAL 9.8
TI-2022-02662 laravel deserialization CVSS 3.1CRITICAL 9.8
TI-2017-12436 In Laravel framework through 5.5.21, remote attackers can obtain sensitive information… CVSS 3.0HIGH 7.5
TI-2022-02676 Laravel deserialization CVSS 3.1HIGH 8.8
TI-2021-04364 Query Binding Exploitation in Laravel CVSS 3.1HIGH 7.2
TI-2020-15251 An issue was discovered in Laravel before 6.18.35 and 7.x before 7.24.0. CVSS 3.1HIGH 7.5

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences