CVE-2025-27515 Laravel has a File Validation Bypass
Attackers can bypass file validation rules in Laravel applications using wildcard validation, potentially uploading malicious files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-27515?
CVE-2025-27515 is a medium-severity vulnerability in laravel framework, published on 5 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.
Weakness: CWE-155
Which versions are affected by CVE-2025-27515?
7 open source packages ship an affected version, including laravel/framework and laravel. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
laravel/framework Packagist | All versions | 10.48.29 |
laravel/framework Packagist | All versions | 10.48.29 |
laravel/framework Packagist | From 11.0.0 | 11.44.1 |
laravel/framework Packagist | From 11.0.0 | 11.44.1 |
laravel/framework Packagist | From 12.0.0 | 12.1.1 |
laravel/framework Packagist | From 12.0.0 | 12.1.1 |
1 more packages
laravel Bitnami | All versions | 12.2.0 |
Products include Laravel Framework.
How do I fix CVE-2025-27515?
Upgrade laravel/framework to a fixed version for your release line: 10.48.29, 11.44.1 or 12.1.1.
Is CVE-2025-27515 being exploited?
There is no known exploitation of CVE-2025-27515 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in laravel framework
Sources
Also known as BIT-laravel-2025-27515, CLSA-2025-1761785337, CLSA-2025-1761785347, CLSA-2026-1779842936, CLSA-2026-1783558967, CLSA-2026-1784077493 and 3 more.