CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay
Priority MEDIUM 41CWE-93Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patched in versions 12.60.0 and 13.10.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00511 43rd percentileScored 2026-11-07
Fix Fixed framework (laravel): 13.10.0, 12.60.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA framework (laravel) Fixed in 13.10.0, 12.60.0
Timeline
- 2026-10-02 Threatist record created from CVE-2026-48019
References
Other 6
- https://github.com/laravel/framework/security/advisories/GHSA-5vg9-5847-vvmq
- https://github.com/laravel/framework/pull/60151
- https://github.com/laravel/framework/commit/96e9a663db657cf37ef26cd794fda8ff60eaa451
- https://github.com/laravel/framework/commit/f336ba79e744257f84ebf0d096b0ebc62e8e1a4d
- https://github.com/laravel/framework/releases/tag/v12.60.0
- https://github.com/laravel/framework/releases/tag/v13.10.0
More Laravel vulnerabilities
- TI-2021-02221 Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated… KEVCVSS 3.1CRITICAL 9.8
- TI-2025-33912 Livewire vulnerable to remote command execution during property update hydration KEVCVSS 4.0CRITICAL 9.2
- TI-2018-10827 In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might… KEVCVSS 3.1HIGH 8.1
- TI-2021-09454 A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows… CVSS 3.1CRITICAL 9.8
- TI-2022-02662 laravel deserialization CVSS 3.1CRITICAL 9.8
- TI-2017-12436 In Laravel framework through 5.5.21, remote attackers can obtain sensitive information… CVSS 3.0HIGH 7.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences