Laravel has a File Validation Bypass

CRITICAL 9.8CVE-2025-27515 · BIT-laravel-2025-27515 · GHSA-78fx-h6xr-vch4 · Published 05/03/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
laravel/framework Packagist	`≥ 11.0.0, < 11.44.1≥ 12.0.0, < 12.1.1< 10.48.29`	`11.44.112.1.110.48.29`
framework laravel	`≥ 12.0.0, < 12.1.1< 11.44.1`	`12.1.111.44.1`

Description

When using wildcard validation to validate a given file or image field array (files.*), a user-crafted malicious request could potentially bypass the validation rules.

NVD description

Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.

References

laravel/framework security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-27515 · ADVISORY
laravel/framework commit 2d13303 · WEB
laravel/framework commit a4f7a8f · WEB
laravel/framework · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free