CVE-2025-27515: Laravel has a File Validation Bypass

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-03-05 · updated 2026-06-17
Weakness: CWE-155

Description

Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.

Affected products

Laravel Framework: before 11.44.1; from 12.0.0 before 12.1.1 — fixed in 11.44.1, 12.1.1
Packagist Laravel/Framework: from 12.0.0 before 12.1.1; from 11.0.0 before 11.44.1; before 10.48.29; v12.0.0, v12.0.1, v12.1.0, v11.0.0, v11.0.1, v11.0.2 (+580) — fixed in 12.1.1, 11.44.1, 10.48.29

How to fix

Upgrade to a fixed version: Laravel Framework 11.44.1, 12.1.1; Packagist Laravel/Framework 12.1.1, 11.44.1, 10.48.29. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-27515 or the next vulnerability affects your stack