Unscored severity · published Apr 16, 2024
CVE-2024-29291
An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/logs/laravel.log
–
CVSS
1.3%
EPSS
No
On KEV
Description
An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/logs/laravel.log. NOTE: this is disputed by multiple third parties because the owner of a Laravel Framework installation can choose to have debugging logs, but needs to set the access control appropriately for the type of data that may be logged.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
Framework · Laravel
8 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-29291
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-29291
gist.github.com
https://gist.github.com/whiteman007/43bd7fa1fa0e47554b33f0cf93066784
More from Framework
9.8
CVE-2025-27515
Laravel has a File Validation Bypass
9.8
CVE-2021-43617
Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for…
9.2
CVE-2026-114509
Laravel TokenGuard authentication bypass through non-string API credentials
8.9
CVE-2026-48019
CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay
8.8
CVE-2020-19316
OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17