CVE-2021-43617 File upload in n/a
Attackers can upload executable PHP files due to missing .phar validation, leading to remote code execution on Debian-based systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-43617?
CVE-2021-43617 is a critical vulnerability in n/a, published on 14 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.
Weakness: CWE-434
Which versions are affected by CVE-2021-43617?
It affects 1 product.
Products include Laravel Framework.
How do I fix CVE-2021-43617?
Upgrade to a fixed version.
Is CVE-2021-43617 being exploited?
There is no known exploitation of CVE-2021-43617 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry and 3 proofs of concept on GitHub.
Other vulnerabilities in n/a
- CVE-2020-19316 OS Command Injection in Laravel Framework
- CVE-2018-6330 SQL injection in n/a
- CVE-2024-13918 Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page
- CVE-2024-13919 Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page
- CVE-2025-27515 Laravel has a File Validation Bypass
Sources
Also known as CLSA-2026-1777596013, DEBIAN-CVE-2021-43617.