CVE-2026-48019High· 8.9▾ MidnightPoC availableLaravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 49 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.7%
Last analysed / modified upstream
1 GitHub repo (last check)
Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patched in versions 12.60.0 and 13.10.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
GHSA-5vg9-5847-vvmqHigh· 8.9Laravel Framework: CRLF injection in default email rule
CVE-2026-102279Low· 3.1Laravel is a web application framework
CVE-2026-114509Critical· 9.2Laravel TokenGuard authentication bypass through non-string API credentials
CVE-2026-116235Critical· 9.1Oray Pugongying X5 Pro L2TP Authentication crlf injection
CVE-2026-116232Critical· 9.9Oray Pugongying X5 Pro SNMP snmp_set crlf injection
CVE-2026-114508Medium· 6.5Laravel relationship inclusion can trigger unauthorized data destruction