Interpretation Conflict in Laravel Framework - #VU166052
Published: November 12, 2026
Vulnerability identifier: #VU166052
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-436
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass temporary signed URL expiration and potentially access protected resources after expiration.
The vulnerability exists due to inconsistent interpretation of raw and parsed query strings in Laravel's signed URL validation when PHP's max_input_vars limit drops the expires parameter, causing signatureHasNotExpired() to treat the URL as non-expiring despite successful raw-query signature verification. A remote attacker can submit an expired signed URL with enough query parameters to exceed max_input_vars, where server and proxy request limits permit, to bypass expiration enforcement.
Affected software
Laravel Framework
Remediation
Install security update from vendor's website.
Laravel Framework - update to 12.72.0