CVE-2025-27515

Laravel is a web application framework. When using wildcard validation to validate a given file or image field (files.*), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.

Published: Mar 5, 2025
Updated: Aug 11, 2025
CVE: CVE-2025-27515
GHSA: GHSA-78fx-h6xr-vch4
Severity: Medium
Exploit:

No technical information available.

CWEs:

CWE-155

Affected Software
References

Software	From	Fixed in
laravel / framework	12.0.0	12.1.1
laravel / framework	11.0.0	11.44.1
laravel / framework	-	10.48.29

https://github.com/laravel/framework/commit/2d133034fefddfb047838f4caca3687a3ba811a5
https://github.com/laravel/framework/commit/a4f7a8f9b83e21882abeef78c3174c66b0f4a26b
https://github.com/laravel/framework/security/advisories/GHSA-78fx-h6xr-vch4

Vulnerability Database

CVE-2025-27515