Security features bypass in Laravel Framework - CVE-2024-52301
Published: November 12, 2024 / Updated: June 20, 2025
Vulnerability identifier: #VU100356
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-52301
CWE-ID: CWE-254
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to the application allows environment variable manipulation when the register_argc_argv php directive is set to on. A remote attacker can query any URL with a special crafted query string and alter values of environment variables. This can result in disclosure of sensitive information and potential unauthorized data manipulation.
Affected software
Laravel Framework
How to mitigate CVE-2024-52301
Install updates from vendor's website.
Laravel Framework - addressed in versions 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, 11.31.0