CVE-2021-3129

highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.999 · 100 %ileexploit · weaponizedEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 35 exploits · weaponized

Likely / severe?

99.9% (100th) EPSS

CVSS 7.5 · high

Is it mine?

8 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

added 2023-09-18remediate by 2023-10-09

required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

EPSS · scored 2026-10-27

Laravel Ignition File Upload Vulnerability

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 3.9 · impact 5.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · OSV

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-94USCWE-94US

ATT&CK techniques

ATT&CK techniques this enables or maps to.

exploits (35)

Public proof-of-concept and weaponised exploit code.

exploit/multi/php/ignition_laravel_debug_rceUnauthenticated remote code execution in Ignitionweaponized · metasploit
EDB-49424Laravel 8.4.2 debug mode - Remote code executionPoC · exploit_db
0nion1/CVE-2021-3129CVE-2021-3129-Laravel Debug modePoC · poc_in_github
0x0d3ad/CVE-2021-3129CVE-2021-3129 (Laravel Ignition RCE Exploit)PoC · poc_in_github
Axianke/CVE-2021-3129CVE-2021-3129PoC · poc_in_github
CyberCTF/vulhub-laravel-cve-2021-3129Vulhub laravel/CVE-2021-3129: Laravel Ignition RCE (CVE-2021-3129), run with IsoloomPoC · poc_in_github

affected products (8)

Products and version ranges known to be affected.

n/a n/a≤ n/aenisa_euvdEU
Facade Ignition≤ 2.5.2fstec_bduRU
Taylor Otwell Laravel≤ 8.4.2fstec_bduRU
facade ignition< 2.5.2nvdUScpe:2.3:a:facade:ignition:*:*:*:*:*:*:*:*
Packagist facade/ignition< 1.6.15osvUSpkg:composer/facade/ignition
Packagist facade/ignition1.7.0 → 1.16.14osvUSpkg:composer/facade/ignition
Packagist facade/ignition2.0.0 → 2.4.2osvUSpkg:composer/facade/ignition
Packagist facade/ignition2.5.0 → 2.5.2osvUSpkg:composer/facade/ignition

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-4qwp-7c67-jmccUnauthenticated remote code execution in Ignition2021-03-29ghsa · osvUS
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd osv NVD CVE.org MITRE

published 2021-01-12modified 2026-07-20

references (15)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan