Read the docs
TI-2024-34976 Aliases CVE-2024-52301GHSA-gv7v-rgg6-548h

Laravel allows environment manipulation via query string

Priority HIGH 73CWE-88Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-88.

Summary

Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0. The framework now ignores argv values for environment detection on non-cli SAPIs.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.44757 98th percentileScored 2026-11-07
Fix Fixed framework (laravel): 6.20.45, 7.30.7, 8.83.28 +3laravel/framework (Packagist): 6.20.45, 7.30.7, 8.83.28 +3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Laravelframeworkbefore 6.20.45; 7.0.0 to before 7.30.7; 8.0.0 to before 8.83.28; 9.0.0 to before 9.52.17; 10.0.0 to before 10.48.23; 11.0.0 to before 11.31.06.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, 11.31.0Patch availableCNA
—laravel/framework (Packagist)before 6.20.456.20.45Patch availableGHSA-gv7v-rgg6-548h
—laravel/framework (Packagist)7.0.0 to before 7.30.77.30.7Patch availableGHSA-gv7v-rgg6-548h
—laravel/framework (Packagist)8.0.0 to before 8.83.288.83.28Patch availableGHSA-gv7v-rgg6-548h
—laravel/framework (Packagist)9.0.0 to before 9.52.179.52.17Patch availableGHSA-gv7v-rgg6-548h
—laravel/framework (Packagist)10.0.0 to before 10.48.2310.48.23Patch availableGHSA-gv7v-rgg6-548h
—laravel/framework (Packagist)11.0.0 to before 11.31.011.31.0Patch availableGHSA-gv7v-rgg6-548h
  • framework VendorLaravel Affected before 6.20.45; 7.0.0 to before 7.30.7; 8.0.0 to before 8.83.28; 9.0.0 to before 9.52.17; 10.0.0 to before 10.48.23; 11.0.0 to before 11.31.0 Fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, 11.31.0 Patch available CNA
  • laravel/framework (Packagist) Vendor— Affected before 6.20.45 Fixed in 6.20.45 Patch available GHSA-gv7v-rgg6-548h
  • laravel/framework (Packagist) Vendor— Affected 7.0.0 to before 7.30.7 Fixed in 7.30.7 Patch available GHSA-gv7v-rgg6-548h
  • laravel/framework (Packagist) Vendor— Affected 8.0.0 to before 8.83.28 Fixed in 8.83.28 Patch available GHSA-gv7v-rgg6-548h
  • laravel/framework (Packagist) Vendor— Affected 9.0.0 to before 9.52.17 Fixed in 9.52.17 Patch available GHSA-gv7v-rgg6-548h
  • laravel/framework (Packagist) Vendor— Affected 10.0.0 to before 10.48.23 Fixed in 10.48.23 Patch available GHSA-gv7v-rgg6-548h
  • laravel/framework (Packagist) Vendor— Affected 11.0.0 to before 11.31.0 Fixed in 11.31.0 Patch available GHSA-gv7v-rgg6-548h

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:laravel:framework:*:*:*:*:*:*:*:*before 6.20.45; 7.0.0 to before 7.30.7; 8.0.0 to before 8.83.28; 9.0.0 to before 9.52.17; 10.0.0 to before 10.48.23; 11.0.0 to before 11.31.0VulnerableLaravel
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:a:laravel:framework:*:*:*:*:*:*:*:* Versions before 6.20.45; 7.0.0 to before 7.30.7; 8.0.0 to before 8.83.28; 9.0.0 to before 9.52.17; 10.0.0 to before 10.48.23; 11.0.0 to before 11.31.0 Vulnerable ·Laravel
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

  • Fix · CNA framework (laravel) Fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, 11.31.0
  • Fix · GHSA-gv7v-rgg6-548h laravel/framework (Packagist) Fixed in 6.20.45 Advisory →
  • Fix · GHSA-gv7v-rgg6-548h laravel/framework (Packagist) Fixed in 7.30.7 Advisory →
  • Fix · GHSA-gv7v-rgg6-548h laravel/framework (Packagist) Fixed in 8.83.28 Advisory →
  • Fix · GHSA-gv7v-rgg6-548h laravel/framework (Packagist) Fixed in 9.52.17 Advisory →
  • Fix · GHSA-gv7v-rgg6-548h laravel/framework (Packagist) Fixed in 10.48.23 Advisory →
  • Fix · GHSA-gv7v-rgg6-548h laravel/framework (Packagist) Fixed in 11.31.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-52301
  2. 2026-10-03 Alias added: GHSA-gv7v-rgg6-548h

References

Advisory 4

Other 2

  • TI-2024-12938 Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page CVSS 3.1HIGH 8.0
  • TI-2024-12937 Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page CVSS 3.1HIGH 8.0
  • TI-2022-19208 The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be… CVSS 3.1MEDIUM 5.3
  • TI-2021-19485 Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP… CVSS 3.1CRITICAL 9.8
  • TI-2020-13600 OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17. CVSS 3.1HIGH 8.8
  • TI-2018-04655 Laravel 5.4.15 is vulnerable to Error based SQL injection in save.php via dhx_user and dhx_version parameters. CVSS 3.0HIGH 8.8
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences