CVE-2021-3129 KEVRansomwarePublic exploit Critical · 9.8 EPSS 99.9%

Laravel Ignition File Upload Vulnerability

Laravel · Ignition

Summary

The flaw is an insecure use of file_get_contents() and file_put_contents() in Laravel's Ignition component, which is the error-page and debugging tool shipped with Ignition before 2.5.2 and with Laravel before 8.4.2. An unauthenticated remote attacker can execute arbitrary code over the network without user interaction, provided the affected site is running in debug mode.

Official description · NVD

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

Breakdown

83.7 / 100

Exploited: Yes, in CISA KEV
Reports: 1
Tactics: 2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Break in through an internet-facing appT1190 · Exploit Public-Facing ApplicationSource data149 general detection rules
What they do
- Run commands on the systemT1059 · Command and Scripting InterpreterSource data95 general detection rules

First seen exploited 2 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 1 day after disclosure.

Disclosed12 Jan 2021day 0
Public exploit codePoC-in-GitHub13 Jan 2021+1 day
First seen exploitedVulnCheck KEV evidence18 Mar 2021+2 mo
Added to CISA KEVknown ransomware use; EU database agrees18 Sep 2023+3 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

3 fixes in facade/ignition over 17 months. The latest fix listed for facade/ignition is 2.5.2.

Fixes in facade/ignitionPackagist package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

2.0.5CVE-2020-139097 Jun 2020
2.0.6CVE-2021-4399617 Nov 2021
2.5.2CVE-2021-312912 Jan 2021KEVLatest listed

techniques

2 , grouped by in kill-chain order 2

Initial AccessTA0001

Exploit Public-Facing Application T1190

MITRE CTID mapping of the KEV entry · how it is exploited

This vulnerability is exploited when a remote unauthorized user sends a malicious payload to a server using an insecure version of Ignition. The payload targets the MakeViewVariableOptionalSolution.php module, leveraging insecure PHP functions file_get_contents and file_put_contents to specify a file path for executing arbitrary code.

ExecutionTA0002

Command and Scripting Interpreter T1059

MITRE CTID mapping of the KEV entry · primary impact

Detection

0 rules for this CVE · 244 general rules for its techniques

Rules for this CVE

0 that reference CVE-2021-3129 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules

Arcadyan Router Exploitationscriticaltest
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
Citrix Netscaler Attack CVE-2019-19781criticaltest
Confluence Exploitation CVE-2019-3398criticaltest
CVE-2010-5278 Exploitation Attemptcriticaltest
CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest

All 149 on SigmaHQ ↗

Command and Scripting InterpreterT105995 general rules

HackTool - Sliver C2 Implant Activity Patterncriticaltest
Lazarus Group Activitycriticaltest
REvil Kaseya Incident Malware Patternscriticaltest
Turla Group Lateral Movementcriticaltest
Windows Defender AMSI Trigger Detectedhighstable
Windows Defender Threat Detectedhighstable
Abusable DLL Potential Sideloading From Suspicious Locationhightest
Add Insecure Download Source To Wingethightest

All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: facade/ignition.

Packagistfacade/ignitionGHSA-4qwp-7c67-jmcc

Upgrade to 2.5.2 or later

Set the version to 2.5.2 or later in your composer.json.

The first fix for CVE-2021-3129. No other CVE tracked by Patchfirst affects this package.

Affected versions, by release line

If you run	Upgrade to
2.5.0 up to 2.5.2	2.5.2
2.0.0 up to 2.4.2	2.4.2
1.7.0 up to 1.16.14	1.16.14
All versions before 1.6.15	1.6.15

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Named in 1 threat report

1 reportEclecticIQ

Reports are matched by finding the exact id CVE-2021-3129 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

EclecticIQUndated

Chinese Threat Actor Used Modified Cobalt Strike Variant to Attack Taiwanese Critical Infrastructure

Mentions the CVE; no further detail.

2 passages name itOriginal (opens in a new tab) ↗

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
44 more on OTX

References

5 links, grouped by NVD tag (4 duplicates merged)

Exploitation evidence

Exploited in the wild

Listed since 18 Sep 2023. Federal due date 9 Oct 2023. Known ransomware use.

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

ENISA

Marked exploited since 18 Sep 2023. EUVD-2021-0599

Laravel 8.4.2 debug mode - Remote code executionEDB-49424 · webapps · php · 2021-01-14

, 30 Oct 2026

99.9%Top 0.03%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.97%).

3.1

9.8Critical · 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 2053 days ago 0.0/10

Known ransomware useCISA KEV and VulnCheck KEV: Known 10.0/10

EPSS percentilepercentile 0.9997 20.0/20

Threat reports1 report 3.9/10

Public exploit code3 NVD references tagged Exploit; 1 Exploit-DB entry; 29 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 9.8 6.9/7

End-of-life productsupported or unknown 0.0

Total83.7

Record

Published: 12 Jan 2021
Modified: 17 Jun 2026
: None assigned
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Fixes in facade/ignitionPackagist package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques