Laravel Ignition File Upload Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 18/09/2023. Patch affected systems as an emergency. It is known to be used in ransomware campaigns.
| Package | Affected versions | Patched versions |
|---|---|---|
| facade/ignition | ≥ 1.7.0, < 1.16.14≥ 2.0.0, < 2.4.2≥ 2.5.0, < 2.5.2< 1.6.15 | 1.16.142.4.22.5.21.6.15 |
| ignition | < 2.5.2 | 2.5.2 |
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free