Read the docs
TI-2020-15251 Aliases CVE-2020-24941GHSA-w68r-5p45-5rqp

An issue was discovered in Laravel before 6.18.35 and 7.x before 7.24.0.

Priority LOW 35CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

An issue was discovered in Laravel before 6.18.35 and 7.x before 7.24.0. The $guarded property is mishandled in some situations involving requests with JSON column nesting expressions.

Why it matters now

EPSS 0.0109 65th percentileScored 2026-11-07
Fix Fixed laravel/framework (Packagist): 6.18.35, 7.24.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—laravel/framework (Packagist)before 6.18.356.18.35Patch availableGHSA-w68r-5p45-5rqp
—laravel/framework (Packagist)7.0.0 to before 7.24.07.24.0Patch availableGHSA-w68r-5p45-5rqp
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • laravel/framework (Packagist) Vendor— Affected before 6.18.35 Fixed in 6.18.35 Patch available GHSA-w68r-5p45-5rqp
  • laravel/framework (Packagist) Vendor— Affected 7.0.0 to before 7.24.0 Fixed in 7.24.0 Patch available GHSA-w68r-5p45-5rqp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:laravel:laravel:*:*:*:*:*:*:*:*before 6.18.35; 7.0.0 to before 7.24.0VulnerableLaravel
  • cpe:2.3:a:laravel:laravel:*:*:*:*:*:*:*:* Versions before 6.18.35; 7.0.0 to before 7.24.0 Vulnerable ·Laravel

Remediation

  • Fix · GHSA-w68r-5p45-5rqp laravel/framework (Packagist) Fixed in 6.18.35 Advisory →
  • Fix · GHSA-w68r-5p45-5rqp laravel/framework (Packagist) Fixed in 7.24.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-24941
  2. 2026-10-03 Alias added: GHSA-w68r-5p45-5rqp

References

Advisory 2

Other 1

  • TI-2018-10827 In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might… KEVCVSS 3.1HIGH 8.1
  • TI-2021-09454 A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows… CVSS 3.1CRITICAL 9.8
  • TI-2022-02662 laravel deserialization CVSS 3.1CRITICAL 9.8
  • TI-2017-12436 In Laravel framework through 5.5.21, remote attackers can obtain sensitive information… CVSS 3.0HIGH 7.5
  • TI-2022-02676 Laravel deserialization CVSS 3.1HIGH 8.8
  • TI-2021-04364 Query Binding Exploitation in Laravel CVSS 3.1HIGH 7.2
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences