{"id":"CVE-2025-27515","published":"2025-03-05T18:45:50Z","modified":"2025-03-05T18:59:49Z","title":"Laravel has a File Validation Bypass","vendor":"laravel","product":"framework","tier":"tail","description":{"text":"Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.9,"severity":"MEDIUM","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00749,"percentile":0.54784,"provenance":"source"},"cwes":[{"id":"CWE-155","name":"Improper Neutralization of Wildcards or Matching Symbols"}],"references":[{"url":"https://github.com/laravel/framework/security/advisories/GHSA-78fx-h6xr-vch4","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/laravel/framework/commit/2d133034fefddfb047838f4caca3687a3ba811a5","tags":["x_refsource_MISC"]}],"priority":{"score":20.8,"factors":[{"name":"EPSS percentile","points":10.96},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":4.83}]},"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2025-12-30","earliestUrl":"https://github.com/joaovicdev/EXPLOIT-CVE-2025-27515","repos":[{"name":"joaovicdev/EXPLOIT-CVE-2025-27515","url":"https://github.com/joaovicdev/EXPLOIT-CVE-2025-27515","stars":2,"created":"2025-12-30"},{"name":"Shanks2001/Progetto-sicurezza","url":"https://github.com/Shanks2001/Progetto-sicurezza","stars":0,"created":"2026-10-19"}]},"first":{"date":"2025-12-30","source":"PoC-in-GitHub","url":"https://github.com/joaovicdev/EXPLOIT-CVE-2025-27515"},"provenance":"source"},"vendorSlug":"laravel","affectedVersions":[{"vendor":"laravel","product":"framework","versions":[">= 12.0.0, < 12.1.1","< 11.44.1"]}],"affected":[{"ecosystem":"Packagist","package":"laravel/framework","vulnerableRanges":[">=12.0.0, <12.1.1",">=11.0.0, <11.44.1","<10.48.29"],"patched":["12.1.1","11.44.1","10.48.29"],"from":["GHSA-78fx-h6xr-vch4"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-6153","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2024-52301","published":"2024-11-12","fixed":"11.31.0","kev":false,"link":{"from":"CVE-2024-52301","to":"CVE-2025-27515","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:laravel/framework","fromFixed":"10.48.23","toFixed":"10.48.29","daysApart":113}]}},{"cve":"CVE-2024-13918","published":"2025-03-10","fixed":"11.36.0","kev":false,"link":{"from":"CVE-2024-13918","to":"CVE-2025-27515","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:laravel/framework","fromFixed":"11.36.0","toFixed":"11.44.1","daysApart":-5}]}},{"cve":"CVE-2024-13919","published":"2025-03-10","fixed":"11.36.0","kev":false},{"cve":"CVE-2025-27515","published":"2025-03-05","fixed":"12.1.1","kev":false},{"cve":"CVE-2026-114508","published":"2026-10-21","fixed":"13.27.0","kev":false},{"cve":"CVE-2026-114509","published":"2026-10-21","fixed":"13.29.0","kev":false,"link":{"from":"CVE-2025-27515","to":"CVE-2026-114509","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:laravel/framework","fromFixed":"12.1.1","toFixed":"12.68.0","daysApart":595}]}},{"cve":"CVE-2026-102279","published":"2026-09-28","fixed":"13.30.0","kev":false}],"package":"Packagist:laravel/framework"}}