Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a CRLF injection weakness in the Laravel framework's mail component. The root cause is the insufficient validation of user-supplied email addresses for carriage return (CR) and line feed (LF) characters. This vulnerability exists at two levels.
First, the validateEmail function within the ValidatesAttributes concern, which backs the 'email' validation rule, did not check for these characters. This allowed a malicious string like "foo\r\nBcc: victim@example.com"@example.com to pass validation.
Second, even if the validation rule was not used, the Illuminate\Mail\Message class methods (to, from, cc, bcc, etc.) and the Illuminate\Mail\Mailables\Address class constructor would accept these un-sanitized strings and use them to construct email headers. When passed to the underlying Symfony Mailer component, the CRLF characters could be interpreted as the end of a header line, allowing an attacker to inject additional headers (like Bcc) or even modify the email body.
The patch addresses this by adding a preg_match check for \r or \n in both the validateEmail function and within the Address class constructor and related methods in the Message class. This ensures that any attempt to use an email address containing line break characters will be rejected, preventing the injection.
Illuminate\Mail\Mailables\Address::__constructsrc/Illuminate/Mail/Mailables/Address.php
Illuminate\Validation\Concerns\ValidatesAttributes::validateEmailsrc/Illuminate/Validation/Concerns/ValidatesAttributes.php
Illuminate\Mail\Message::fromsrc/Illuminate/Mail/Message.php
Illuminate\Mail\Message::sendersrc/Illuminate/Mail/Message.php
Illuminate\Mail\Message::returnPathsrc/Illuminate/Mail/Message.php
Illuminate\Mail\Message::tosrc/Illuminate/Mail/Message.php
Illuminate\Mail\Message::ccsrc/Illuminate/Mail/Message.php
Illuminate\Mail\Message::bccsrc/Illuminate/Mail/Message.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| laravel/framework | composer | >= 13.0.0, <= 13.9.0 | 13.10.0 |
| laravel/framework | composer | < 12.60.0 | 12.60.0 |