CVE-2025-27515

Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
UNKNOWN
---
GitHub_MCNA
---
---
CISA-ADPADP
---
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 3%
Debian logo
Debian Releases
Debian Product
Codename
php-laravel-framework
bullseye
vulnerable
bullseye (security)
vulnerable
bookworm
vulnerable
sid
10.48.29+dfsg-1
fixed
trixie
10.48.29+dfsg-1
fixed
Common Weakness Enumeration
References
https://github.com/laravel/framework/commit/2d133034fefddfb047838f4caca3687a3ba811a5
https://github.com/laravel/framework/security/advisories/GHSA-78fx-h6xr-vch4