Most recent entries from all

bdu:2021-06021

2026-10-24T07:01:38.868245+00:00

bdu:2021-06021

cnvd-2021-101173

2026-10-24T07:01:38.868282+00:00

cnvd-2021-101173

EUVD-2026-32572

2026-10-24T07:01:38.868304+00:00

EUVD-2026-32572

fkie_cve-2021-43617

2026-10-24T07:01:38.868323+00:00

Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.

Withdrawn: GHSA-364w-9g92-3grq — Withdrawn: Laravel Framework does not sufficiently block the upload of executable PHP content.

2026-10-24T07:01:38.868367+00:00

Withdrawn by the publisher.

Affected: Packagist: laravel/framework

# Withdrawn

This advisory has been withdrawn after the maintainers of Laravel noted this issue is not a security vulnerability with Laravel itself, but rather a userland issue.

## Original CVE based description

Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. In some use cases, this may be related to file-type validation for image upload (e.g., differences between getClientOriginalExtension and other approaches).

gsd-2021-43617

2026-10-24T07:01:38.868417+00:00

gsd-2021-43617