CVE-2021-43617

Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

19.81% chance of exploitation in the next 30 days, 97th percentile

Published

2021-11-14

Updated

2024-08-04

Proof-of-concept exploits (4)

• Sybelle03/CVE-2021-436171★ · 2023-06-08
• aweiiy/CVE-2021-436170★ · 2022-08-03
• dangducloc/CVE_2021_436171★ · 2025-07-06
• kombat1/CVE-2021-436170★ · 2021-11-22

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/50525

References

• CVE Record
• NVD entry

Related

• CVE-2023-51504
• CVE-2022-29078
• CVE-2021-43616
• CVE-2021-43628
• CVE-2021-43609
• CVE-2021-43629