Withdrawn: Laravel Framework does not sufficiently block the upload of executable PHP content.

CRITICAL 9.8CVE-2021-43617 · GHSA-364w-9g92-3grq · Published 14/11/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
laravel/framework Packagist	`≤ 8.70.2`	No fix yet
framework laravel	`≤ 8.70.2`	No fix yet

Description

Withdrawn

This advisory has been withdrawn after the maintainers of Laravel noted this issue is not a security vulnerability with Laravel itself, but rather a userland issue.

Original CVE based description

Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. In some use cases, this may be related to file-type validation for image upload (e.g., differences between getClientOriginalExtension and other approaches).

NVD description

Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.

References

nvd.nist.gov/vuln/detail/CVE-2021-43617 · ADVISORY
laravel/framework · PACKAGE
laravel/framework · WEB
laravel/framework · WEB
hosein-vita.medium.com/laravel-8-x-image-upload-bypass-zero-day-852bd806019b · WEB
salsa.debian.org/php-team/php/-/blob/dc253886b5b2e9bc8d9e36db787abb083a667fd8/debian/php-cgi.conf · WEB
salsa.debian.org/php-team/php/-/commit/dc253886b5b2e9bc8d9e36db787abb083a667fd8 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

laravel/framework

Packagist

≤ 8.70.2

No fix yet

framework

laravel

≤ 8.70.2

No fix yet

Description

Withdrawn

This advisory has been withdrawn after the maintainers of Laravel noted this issue is not a security vulnerability with Laravel itself, but rather a userland issue.

Original CVE based description

NVD description

Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.