CVE-2025-27515

criticalpriority · attend · 49EPSS 0.007 · 54 %ileexploit · PoCDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

2 exploits · PoC

Likely / severe?

0.75% (54th) EPSS

CVSS 9.8 · critical

Is it mine?

14 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-21

Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 5.5–9.8

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v4.06.9mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:Nsecondary · ENISA EU

v4.06.9mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · security-advisories@github.com

v4.05.5mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-155USCWE-155USCWE-155US

exploits (2)

Public proof-of-concept and weaponised exploit code.

Shanks2001/Progetto-sicurezzaPenetration test white-box su un’app Laravel: analisi Cyber Kill Chain, RCE via file upload bypass (CVE-2025-27515), exfiltration e remediation.PoC · poc_in_github
joaovicdev/EXPLOIT-CVE-2025-27515PoC of CVE-2025-27515PoC · poc_in_github

affected products (14)

Products and version ranges known to be affected.

Open Source Laravel Framework <11.44.1all versionscert_bundDE
Open Source Laravel Framework <12.1.1all versionscert_bundDE
Open Source Laravel< 11.44.1cert_bundDE
Open Source Laravel< 12.1.1cert_bundDE
laravel framework≤ < 11.44.1enisa_euvdEU
laravel framework12.0.0, → 12.1.1enisa_euvdEU
Taylor Otwell Laravel≤ 11.44.1fstec_bduRU
Taylor Otwell Laravel12.0.0 → 12.1.1fstec_bduRU
laravel framework< 11.44.1nvdUScpe:2.3:a:laravel:framework:*:*:*:*:*:*:*:*
laravel framework12.0.0 → 12.1.1nvdUScpe:2.3:a:laravel:framework:*:*:*:*:*:*:*:*
Bitnami laravel< 12.2.0osvUSpkg:bitnami/laravel
Packagist laravel/framework< 10.48.29osvUSpkg:composer/laravel/framework
Packagist laravel/framework11.0.0 → 11.44.1osvUSpkg:composer/laravel/framework
Packagist laravel/framework12.0.0 → 12.1.1osvUSpkg:composer/laravel/framework

advisories (3)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2025-0493Laravel Framework: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2025-03-05csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Laravel Framework ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
GHSA-78fx-h6xr-vch4Laravel has a File Validation Bypass2025-03-05ghsa · osvUS
When using wildcard validation to validate a given file or image field array (`files.*`), a user-crafted malicious request could potentially bypass the validation rules.
BIT-laravel-2025-27515Laravel has a File Validation Bypass2025-04-14vendor · osvUS
Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.

also known as (7)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund nvd NVD CVE.org MITRE

published 2025-03-05modified 2026-06-17

references (8)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan