GHSA-crmm-hgp2-wgrp Laravel Framework: Temporary Signed URL Path Confusion
Attackers can bypass expiration checks on signed URLs and potentially write to unintended locations due to path parsing ambiguities in Laravel's local filesystem driver.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-crmm-hgp2-wgrp?
GHSA-crmm-hgp2-wgrp is a vulnerability in laravel/framework, published on 17 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in Laravel's local filesystem driver allows temporary signed URLs to be parsed ambiguously, potentially misrouting requests and bypassing expiration enforcement.
Under certain conditions, a generated temporary signed URL can be interpreted differently by the server than intended at signing time. This may cause requests to resolve to an unintended resource, and can prevent expiration from being enforced, allowing expired URLs to remain valid indefinitely.
Impact
- Expired temporary URLs may continue to be accepted
- Requests may resolve to a different resource than the one that was signed
- The upload variant may allow writes to reach an unintended destination
Which versions are affected by GHSA-crmm-hgp2-wgrp?
4 open source packages ship an affected version, including laravel/framework.
| Package | Affected | Fixed in |
|---|---|---|
laravel/framework Packagist | All versions | 12.61.1 |
laravel/framework Packagist | All versions | 12.61.1 |
laravel/framework Packagist | From 13.0.0 | 13.12.0 |
laravel/framework Packagist | From 13.0.0 | 13.12.0 |
How do I fix GHSA-crmm-hgp2-wgrp?
Upgrade laravel/framework to a fixed version for your release line: 12.61.1 or 13.12.0.
Is GHSA-crmm-hgp2-wgrp being exploited?
There is no known exploitation of GHSA-crmm-hgp2-wgrp in the wild and no public exploit code.