CVE-2025-27515: Laravel has a File Validation Bypass
6.9
CVSS Score
4.0
Basic Information
CVE ID
GHSA ID
EPSS Score
0.04993%
CWE
Published
3/5/2025
Updated
3/12/2025
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| laravel/framework | composer | >= 12.0.0, < 12.1.1 | 12.1.1 |
| laravel/framework | composer | >= 11.0.0, < 11.44.1 | 11.44.1 |
| laravel/framework | composer | < 10.48.29 | 10.48.29 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The core vulnerability stems from how array keys were processed during validation. The commit shows critical changes to:
- Replace instance-based dotPlaceholder with static placeholderHash to prevent cross-validator conflicts
- Modify attribute handling in validateUsingCustomRule to preserve original attributes for specific rules
- Add tests verifying validation bypass using keys like '0', '.', '*' and 'asterisk'
The validateUsingCustomRule was vulnerable because it didn't properly restore original attribute names when handling File/Password rules, allowing attackers to bypass validation by using array keys that matched the validator's placeholder patterns. parseData's placeholder strategy was insufficient as it didn't account for multiple validator instances sharing static placeholders.