Homepage

CRLF Injection Affecting php-laravel-framework package, versions *

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.51% (42nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN12-PHPLARAVELFRAMEWORK-17140244
  • published4 Jun 2026
  • disclosed4 Sept 2026
Report a new vulnerability Found a mistake?

Introduced: 4 Jun 2026

CVE-2026-48019  (opens in a new tab)
CWE-93  (opens in a new tab)

How to fix?

There is no fixed version for Debian:12 php-laravel-framework.

NVD Description

Note: Versions mentioned in the description apply only to the upstream php-laravel-framework package and not the php-laravel-framework package as distributed by Debian. See How to fix? for Debian:12 relevant fixed versions and status.

Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patched in versions 12.60.0 and 13.10.0.