{"id":"CVE-2021-3129","published":"2021-01-12T15:15:16Z","modified":"2026-06-17T04:04:43Z","title":"Laravel Ignition File Upload Vulnerability","vendor":"Laravel","product":"Ignition","tier":"core","eol":null,"description":{"text":"Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an insecure use of file_get_contents() and file_put_contents() in Laravel's Ignition component, which is the error-page and debugging tool shipped with Ignition before 2.5.2 and with Laravel before 8.4.2. An unauthenticated remote attacker can execute arbitrary code over the network without user interaction, provided the affected site is running in debug mode.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:55:16Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99943,"percentile":0.99973,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2023-09-18","dueDate":"2023-10-09","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://github.com/facade/ignition/releases/tag/2.5.2; https://nvd.nist.gov/vuln/detail/CVE-2021-3129","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-03-18","exploitedFirstSeen":"2021-03-18","ransomware":true,"evidence":[{"url":"https://blog.netlab.360.com/necro-upgrades-again-using-tor-dynamic-domain-dga-and-aiming-at-both-windows-linux/","date":"2021-03-18"},{"url":"https://blogs.juniper.net/en-us/threat-research/sysrv-botnet-expands-and-gains-persistence","date":"2021-04-08"},{"url":"https://www.bleepingcomputer.com/news/security/new-cryptomining-malware-builds-an-army-of-windows-linux-bots/","date":"2021-04-24"},{"url":"https://blog.talosintelligence.com/2021/06/necro-python-bot-adds-new-tricks.html","date":"2021-06-03"},{"url":"https://cujo.com/the-sysrv-botnet-and-how-it-evolved/","date":"2021-09-22"},{"url":"https://www.botconf.eu/wp-content/uploads/2022/05/Botconf2022-24-PalotayZsigovits.pdf","date":"2022-04-27"},{"url":"https://darktrace.com/blog/worm-like-propagation-of-sysrv-hello-crypto-jacking-botnet","date":"2022-05-22"},{"url":"https://blog.eclecticiq.com/chinese-threat-actor-used-modified-cobalt-strike-variant-to-attack-taiwanese-critical-infrastructure","date":"2023-06-02"},{"url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/honeypot-recon-enterprise-applications-honeypot-unveiling-findings-from-six-worldwide-locations/","date":"2023-07-05"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-09-18"}],"evidenceTotal":1056,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[],"references":[{"url":"http://packetstormsecurity.com/files/162094/Ignition-2.5.1-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165999/Ignition-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/facade/ignition/pull/334","tags":["Patch","Third Party Advisory"]},{"url":"https://www.ambionics.io/blog/laravel-debug-rce","tags":["Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/162094/Ignition-2.5.1-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165999/Ignition-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/facade/ignition/pull/334","tags":["Patch","Third Party Advisory"]},{"url":"https://www.ambionics.io/blog/laravel-debug-rce","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3129","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Unrestricted File Upload","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited when a remote unauthorized user sends a malicious payload to a server using an insecure version of Ignition. The payload targets the MakeViewVariableOptionalSolution.php module, leveraging insecure PHP functions file_get_contents and file_put_contents to specify a file path for executing arbitrary code. ","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Unrestricted File Upload","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited when a remote unauthorized user sends a malicious payload to a server using an insecure version of Ignition. The payload targets the MakeViewVariableOptionalSolution.php module, leveraging insecure PHP functions file_get_contents and file_put_contents to specify a file path for executing arbitrary code. ","confidence":"high"}],"reports":[{"id":"SRC-00137fe8f183bbad0ec9","title":"Chinese Threat Actor Used Modified Cobalt Strike Variant to Attack Taiwanese Critical Infrastructure","publisher":"blog.eclecticiq.com","url":"https://blog.eclecticiq.com/chinese-threat-actor-used-modified-cobalt-strike-variant-to-attack-taiwanese-critical-infrastructure","date":null,"mentions":[{"quote":"threat actor primarily focuses on four different known remote code execution (RCE) vulnerabilities during their operations:•    CVE-2023-21839      Oracle WebLogic Server RCE [13]•    CVE-2021-3129      Laravel debug mode RCE [14]•    CVE-2020-2551      Oracle WebLogic RCE [15]•    CVE-2021-44228     Apache Log4j","start":4810,"end":5124},{"quote":"[14]      “NVD - CVE-2021-3129.”","start":23110,"end":23142},{"quote":"https://nvd.nist.gov/vuln/detail/CVE-2021-3129 (accessed Apr.","start":23143,"end":23204}]}],"affected":[{"ecosystem":"Packagist","package":"facade/ignition","vulnerableRanges":[">=2.5.0, <2.5.2",">=2.0.0, <2.4.2",">=1.7.0, <1.16.14","<1.6.15"],"patched":["2.5.2","2.4.2","1.16.14","1.6.15"],"from":["GHSA-4qwp-7c67-jmcc"],"provenance":"source"}],"advisories":[{"id":"GHSA-4qwp-7c67-jmcc","url":"https://github.com/advisories/GHSA-4qwp-7c67-jmcc","severity":"CRITICAL","ecosystem":"Packagist","package":"facade/ignition","vulnerableRanges":[">=2.5.0, <2.5.2"],"patched":["2.5.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-4qwp-7c67-jmcc","url":"https://github.com/advisories/GHSA-4qwp-7c67-jmcc","severity":"CRITICAL","ecosystem":"Packagist","package":"facade/ignition","vulnerableRanges":[">=2.0.0, <2.4.2"],"patched":["2.4.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-4qwp-7c67-jmcc","url":"https://github.com/advisories/GHSA-4qwp-7c67-jmcc","severity":"CRITICAL","ecosystem":"Packagist","package":"facade/ignition","vulnerableRanges":[">=1.7.0, <1.16.14"],"patched":["1.16.14"],"provenance":"source","from":"GHSA"},{"id":"GHSA-4qwp-7c67-jmcc","url":"https://github.com/advisories/GHSA-4qwp-7c67-jmcc","severity":"CRITICAL","ecosystem":"Packagist","package":"facade/ignition","vulnerableRanges":["<1.6.15"],"patched":["1.6.15"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2021-0599","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-0599","exploited":true,"exploitedSince":"2023-09-18","provenance":"source"},"exploits":[{"id":49424,"url":"https://www.exploit-db.com/exploits/49424","title":"Laravel 8.4.2 debug mode - Remote code execution","type":"webapps","platform":"php","date":"2021-01-14","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2021-01-14"},"pocGithub":{"count":29,"skipped":4,"earliest":"2021-01-13","earliestUrl":"https://github.com/ambionics/laravel-exploits","repos":[{"name":"ambionics/laravel-exploits","url":"https://github.com/ambionics/laravel-exploits","stars":289,"created":"2021-01-13"},{"name":"zhzyker/CVE-2021-3129","url":"https://github.com/zhzyker/CVE-2021-3129","stars":166,"created":"2021-02-18"},{"name":"joshuavanderpoll/CVE-2021-3129","url":"https://github.com/joshuavanderpoll/CVE-2021-3129","stars":157,"created":"2022-04-16"},{"name":"SNCKER/CVE-2021-3129","url":"https://github.com/SNCKER/CVE-2021-3129","stars":134,"created":"2021-01-22"},{"name":"SecPros-Team/laravel-CVE-2021-3129-EXP","url":"https://github.com/SecPros-Team/laravel-CVE-2021-3129-EXP","stars":79,"created":"2021-01-25"}]},"metasploit":[{"name":"Unauthenticated remote code execution in Ignition","module":"exploit/multi/php/ignition_laravel_debug_rce","type":"exploit","disclosureDate":"2021-01-13","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/php/ignition_laravel_debug_rce.rb"}],"nuclei":[{"id":"CVE-2021-3129","name":"Laravel with Ignition <= v8.4.2 Debug Mode - Remote Code Execution","severity":"critical","path":"http/cves/2021/CVE-2021-3129.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3129.yaml"}],"first":{"date":"2021-01-13","source":"PoC-in-GitHub","url":"https://github.com/ambionics/laravel-exploits"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/162094/Ignition-2.5.1-Remote-Code-Execution.html","http://packetstormsecurity.com/files/165999/Ignition-Remote-Code-Execution.html","https://www.ambionics.io/blog/laravel-debug-rce"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"}],"timeline":[{"date":"2021-01-12","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3129","provenance":"source"},{"date":"2021-01-13","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2021-01-13, Exploit-DB 2021-01-14","url":"https://github.com/ambionics/laravel-exploits","provenance":"source"},{"date":"2021-03-18","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.netlab.360.com/necro-upgrades-again-using-tor-dynamic-domain-dga-and-aiming-at-both-windows-linux/","provenance":"source"},{"date":"2023-09-18","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-09-18","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-0599","provenance":"source"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"PoC-in-GitHub","daysToKev":979},"priority":{"score":83.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2052 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9997"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit; 1 Exploit-DB entry; 29 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2020-13909","published":"2020-06-07","fixed":"2.0.5","kev":false},{"cve":"CVE-2021-43996","published":"2021-11-17","fixed":"2.0.6","kev":false,"link":{"from":"CVE-2021-3129","to":"CVE-2021-43996","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:facade/ignition","fromFixed":"1.16.14","toFixed":"1.16.15","daysApart":309},{"kind":"similar","provenance":"machine","score":0.46,"basis":"same package + description similarity"}]}},{"cve":"CVE-2021-3129","published":"2021-01-12","fixed":"2.5.2","kev":true}],"package":"Packagist:facade/ignition"}}