Laravel · Laravel Framework
CVE-2018-15133
Laravel Deserialization of Untrusted Data Vulnerability
What it is
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.
CISA: Laravel Framework contains a deserialization of untrusted data vulnerability, allowing for remote command execution. This vulnerability may only be exploited if a malicious user has accessed the application encryption key (APP_KEY environment variable).
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: February 6, 2024
More exploited flaws from Laravel
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Mar 20, 2026 | Code Injection | Livewire | Critical 9.2 | 96% |
| Sep 18, 2023 | File Upload | Ignition | Critical 9.8 | 99.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.