CVE-2021-43617 - CVE House
Back to Database
Status published Critical CVE-2021-43617

Laravel Framework through 8.70.2 does not sufficiently block the upload...

Vulnerability Description

Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-43617

Credits & Attribution

No credits recorded in the NVD database.

References

More from laravel

View All →
CVE-2025-27515
Laravel has a File Validation Bypass
Medium 6.9
CVE-2024-55661
Laravel Pulse Allows Remote Code Execution via Unprotected Query Method
High 8.7
CVE-2024-52301
Laravel allows environment manipulation via query string
High 8.7
CVE-2024-50347
Laravel Reverb has Missing API Signature Verification
Medium 6.3
CVE-2022-40482
The authentication method in Laravel 8.x through 9.x before 9.32.0...
Unknown 0

Affected Vendor

Affected Software

framework
Vulnerable Versions:
0

Timeline

Official Publish: November 14th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.