SB2026111238 - Multiple vulnerabilities in Laravel Framework

Description

This security bulletin contains information about 2 vulnerabilities.

1) Improper Encoding or Escaping of Output (CVE-ID: N/A)

CWE-ID: CWE-116 - Improper Encoding or Escaping of Output

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass expiration restrictions on temporary signed URLs.

The vulnerability exists due to missing URL encoding in Laravel's temporarySignedRoute() and signedRoute() methods when applications forward attacker-influenced, numeric-keyed parameters that do not fill route placeholders into signed URL generation. A remote attacker can inject a second expires query parameter, covered by the signature but treated as authoritative during request parsing, to make the signed URL never expire.

2) Interpretation Conflict (CVE-ID: N/A)

CWE-ID: CWE-436 - Interpretation Conflict

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass temporary signed URL expiration and potentially access protected resources after expiration.

The vulnerability exists due to inconsistent interpretation of raw and parsed query strings in Laravel's signed URL validation when PHP's max_input_vars limit drops the expires parameter, causing signatureHasNotExpired() to treat the URL as non-expiring despite successful raw-query signature verification. A remote attacker can submit an expired signed URL with enough query parameters to exceed max_input_vars, where server and proxy request limits permit, to bypass expiration enforcement.

Remediation

Install update from vendor's website.

References

• https://github.com/laravel/framework/security/advisories/GHSA-6rv8-qj5v-p8ch
• https://github.com/laravel/framework/security/advisories/GHSA-v5ch-g375-82r6