GHSA-3wgq-h4fr-cwg5 laravel-crud-wizard-free has File Validation Bypass
An attacker can bypass file validation in the Laravel CRUD Wizard package, potentially uploading malicious files to execute code or modify data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-3wgq-h4fr-cwg5?
GHSA-3wgq-h4fr-cwg5 is a vulnerability in macropay-solutions/laravel-crud-wizard-free, published on 12 Mar 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Impact
Medium
Patches
Version 3.4.17 fixes illuminate/validation v 8.0.0 to 11.44.0
Workarounds
Register \MacropaySolutions\LaravelCrudWizard\Providers\ValidationServiceProvider instead of Illuminate\Validation\ValidationServiceProvider::class if you are using illuminate/validation < 11.44.1
References
https://github.com/laravel/framework/security/advisories/GHSA-78fx-h6xr-vch4
Which versions are affected by GHSA-3wgq-h4fr-cwg5?
2 open source packages ship an affected version, including macropay-solutions/laravel-crud-wizard-free.
| Package | Affected | Fixed in |
|---|---|---|
macropay-solutions/laravel-crud-wizard-free Packagist | All versions | 3.4.17 |
macropay-solutions/laravel-crud-wizard-free Packagist | All versions | 3.4.17 |
How do I fix GHSA-3wgq-h4fr-cwg5?
Upgrade macropay-solutions/laravel-crud-wizard-free to 3.4.17 or later.
Is GHSA-3wgq-h4fr-cwg5 being exploited?
There is no known exploitation of GHSA-3wgq-h4fr-cwg5 in the wild and no public exploit code.