What’s Vulnerable › Vulnerabilities

CVE-2026-48019: CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay

• Severity: high (CVSS 8.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-04 · updated 2026-09-10
• Weakness: CWE-93

Description

Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patched in versions 12.60.0 and 13.10.0.

Affected products

• Packagist Laravel/Framework: from 13.0.0 before 13.10.0; before 12.60.0; v13.0.0, v13.1.0, v13.1.1, v13.2.0, v13.3.0, v13.4.0 (+505) — fixed in 13.10.0, 12.60.0
• Laravel Framework: from 13.0.0, < 13.10.0; before 12.60.0

How to fix

Upgrade to a fixed version: Packagist Laravel/Framework 13.10.0, 12.60.0. Check the vendor advisory for mitigations.

References

• https://github.com/laravel/framework/commit/96e9a663db657cf37ef26cd794fda8ff60eaa451
• https://github.com/laravel/framework/commit/f336ba79e744257f84ebf0d096b0ebc62e8e1a4d
• https://github.com/laravel/framework/pull/60151
• https://github.com/laravel/framework/releases/tag/v12.60.0
• https://github.com/laravel/framework/releases/tag/v13.10.0
• https://github.com/laravel/framework/security/advisories/GHSA-5vg9-5847-vvmq

Get alerted when CVE-2026-48019 or the next vulnerability affects your stack