$ cve CVE-2021-43617 JSON

CVE-2021-43617 EXPLOIT

9.8

CRITICAL · CVSS 3.1 · EPSS 19.8% (pctl 97)

Patch early

A public exploit exists.

Description

Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	19.81% — more likely to be exploited than 97% of all CVEs
Weakness	CWE-434
On CISA KEV	no
Public exploit	yes
Published	2021-11-14
Last modified	2026-06-17

Affected (1)

Vendor	Product
laravel	framework

Public exploits

Source	Title	Date
exploit-db	PHP Laravel 8.70.1 - Cross Site Scripting (XSS) to Cross Site Request Forgery (CSRF)	2021-11-15

References

→ the Explorer · watch your stack · NVD