CVE catalog

CVE-2021-43617

php-laravel-framework: CVE-2021-43617

Severity: Medium
Published: Nov 14, 2021, 4:15:08 PM UTC
Source: [NVD] · [CVE record]
EPSS: 19.81% · Oct 25, 2026

Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	php-laravel-framework	sid	`13.31.0+dfsg-1`	fixed
Debian	php-laravel-framework	forky	`11.46.1+dfsg-4`	fixed
Debian	php-laravel-framework	trixie	`10.48.29+dfsg-1`	fixed
Debian	php-laravel-framework	bookworm	`8.83.26+dfsg-2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	php-laravel-framework	source	sid	`6.20.14+dfsg-3`	not yet assigned	Not reported	[1002728]
Debian	php-laravel-framework	source	forky	`6.20.14+dfsg-3`	not yet assigned	Not reported	[1002728]
Debian	php-laravel-framework	source	trixie	`6.20.14+dfsg-3`	not yet assigned	Not reported	[1002728]
Debian	php-laravel-framework	source	bookworm	`6.20.14+dfsg-3`	not yet assigned	Not reported	[1002728]

[Debian bug #1002728]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[php-illuminate-auth]Fixed
Source package: [php-laravel-framework]
Details (2)
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
[php-illuminate-broadcasting]Fixed
Source package: [php-laravel-framework]
Details (2)
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
[php-illuminate-bus]Fixed
Source package: [php-laravel-framework]
Details (2)
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
[php-illuminate-cache]Fixed
Source package: [php-laravel-framework]
Details (2)
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
[php-illuminate-collections]Fixed
Source package: [php-laravel-framework]
Details (2)
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
[php-illuminate-config]Fixed
Source package: [php-laravel-framework]
Details (2)
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
[php-illuminate-console]Fixed
Source package: [php-laravel-framework]
Details (2)
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
[php-illuminate-container]Fixed
Source package: [php-laravel-framework]
Details (2)
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
[php-illuminate-contracts]Fixed
Source package: [php-laravel-framework]
Details (2)
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
[php-illuminate-cookie]Fixed
Source package: [php-laravel-framework]
Details (2)
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
[php-illuminate-database]Fixed
Source package: [php-laravel-framework]
Details (2)
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
[php-illuminate-encryption]Fixed
Source package: [php-laravel-framework]
Details (2)
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
[php-illuminate-events]Fixed
Source package: [php-laravel-framework]
Details (2)
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
[php-illuminate-filesystem]Fixed
Source package: [php-laravel-framework]
Details (2)
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
[php-illuminate-hashing]Fixed
Source package: [php-laravel-framework]
Details (2)
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
[php-illuminate-http]Fixed
Source package: [php-laravel-framework]
Details (2)
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
[php-illuminate-log]Fixed
Source package: [php-laravel-framework]
Details (2)
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
[php-illuminate-macroable]Fixed
Source package: [php-laravel-framework]
Details (2)
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
[php-illuminate-mail]Fixed
Source package: [php-laravel-framework]
Details (2)
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
[php-illuminate-notifications]Fixed
Source package: [php-laravel-framework]
Details (2)
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12
- 8.83.26+dfsg-2 · all · bookworm
  Fixed · Fixed: 6.20.14+dfsg-3
  dsa · php-laravel-framework · debian · bookworm; dsa · php-laravel-framework · debian · 12

Next results

Observed: Oct 23, 2026, 6:03:29 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]