Security Advisory
CVE-2021-43617
9.8
CRITICAL
Vulnerability Description
Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.
Published Date
November 14, 2021
Official Source
NIST NVD Advisory