High severity · published Nov 12, 2024
CVE-2024-52301
Laravel allows environment manipulation via query string
7.5
CVSS
44.8%
EPSS
No
On KEV
Description
Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0. The framework now ignores argv values for environment detection on non-cli SAPIs.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)44.8% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
framework · laravel
< 6.20.45; >= 7.0.0, < 7.30.7; >= 8.0.0, < 8.83.28; >= 9.0.0, < 9.52.17; >= 10.0.0, < 10.48.23; >= 11.0.0, < 11.31.0 · source: vendor, NVD, CISA
DL
Debian Linux · Debian
11.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-52301
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-52301
Vendor Advisory
https://github.com/laravel/framework/security/advisories/GHSA-gv7v-rgg6-548h
Mailing List
https://lists.debian.org/debian-lts-announce/2024/12/msg00019.html
More from framework
9.8
CVE-2025-27515
Laravel has a File Validation Bypass
9.8
CVE-2021-43617
Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for…
9.2
CVE-2026-114509
Laravel TokenGuard authentication bypass through non-string API credentials
8.9
CVE-2026-48019
CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay
8.8
CVE-2020-19316
OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17