Laravel framework susceptible to reflected cross-site scripting

MEDIUM 6.1CVE-2024-13918 · GHSA-546h-56qp-8jmw · Published 10/03/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
laravel/framework Packagist	`≥ 11.9.0, < 11.36.0`	`11.36.0`
framework laravel	`≥ 11.9.0, < 11.36.0`	`11.36.0`

Description

The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page.

NVD description

The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page.

References

nvd.nist.gov/vuln/detail/CVE-2024-13918 · ADVISORY
laravel/framework#53869 · WEB
laravel/framework commit 45287fb · WEB
FriendsOfPHP/security-advisories · WEB
laravel/framework · PACKAGE
laravel/framework release v11.36.0 · WEB
sbaresearch/advisories · WEB
openwall.com/lists/oss-security/2025/03/10/3 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free