EN PT-BR
← Voltar ao feed
high

CERT-FR Advisory: Remote Code Execution Vulnerability in Laravel Framework Before 13.40.0

1 fonte(s) · 1 atualização(ões) · publicado 03/11/2026 21:00 · coletado há 1 hora

CERT-FR published advisory CERTFR-2026-AVI-1457 on 04 November 2026 regarding a vulnerability in Laravel affecting versions prior to 13.40.0. The flaw allows an attacker to achieve arbitrary remote code execution. The issue is tracked under the vendor's security advisory GHSA-63hm-g96r-2m2q, published the same day. No CVE identifier, exploitation status, or technical root-cause details are provided in the advisory.

Entenda a falha

A vulnerabilidade

A remote code execution flaw affects the Laravel PHP framework in all versions before 13.40.0. According to CERT-FR, an attacker can use it to run arbitrary code remotely. The advisory gives no CVE, no CVSS score and no details on prerequisites such as authentication, configuration or user interaction. The fix is in Laravel 13.40.0, and the vendor advisory is GHSA-63hm-g96r-2m2q.

Como foi descoberta

The sources do not say who found the flaw or how. CERT-FR published advisory CERTFR-2026-AVI-1457 on 4 November 2026, pointing to the Laravel security advisory GHSA-63hm-g96r-2m2q released the same day. The advisory does not say whether the flaw is being exploited.

Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 16:24.

Detalhes técnicos

  • Affected: Laravel framework versions prior to 13.40.0.
  • Impact: remote code execution (arbitrary code execution).
  • Reference: Laravel security bulletin GHSA-63hm-g96r-2m2q (04 November 2026).

Remediação

  • Update to Laravel version 13.40.0 or later as referenced in the vendor's security bulletin GHSA-63hm-g96r-2m2q.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 03/11/2026 21:00 · coletado 05/11 16:00 primeiro registro

    CERT-FR Advisory: Remote Code Execution Vulnerability in Laravel Framework Before 13.40.0

    ler a análise desta fonte

    CERT-FR published advisory CERTFR-2026-AVI-1457 on 04 November 2026 regarding a vulnerability in Laravel affecting versions prior to 13.40.0. The flaw allows an attacker to achieve arbitrary remote code execution. The issue is tracked under the vendor's security advisory GHSA-63hm-g96r-2m2q, published the same day. No CVE identifier, exploitation status, or technical root-cause details are provided in the advisory.

    Technical Details

    • Affected: Laravel framework versions prior to 13.40.0.
    • Impact: remote code execution (arbitrary code execution).
    • Reference: Laravel security bulletin GHSA-63hm-g96r-2m2q (04 November 2026).

    Remediation

    • Update to Laravel version 13.40.0 or later as referenced in the vendor's security bulletin GHSA-63hm-g96r-2m2q.