Web Programming
Español

Patch nowPHP & Laravel

Laravel's summer advisories: CRLF injection, signed URL path confusion and a debug-page XSS

Issue #1

Three framework advisories landed this summer, including a High-severity CRLF injection in the default email validation rule.

Karlen TriminoSenior Full-Stack Engineer

Leer en español
Photo: Towfiqu barbhuiya / Pexels

What to do

Update to the latest Laravel 13.x or 12.x patch release.

Three framework advisories landed this summer: a High-severity CRLF injection in the default email validation rule (June 1), a temporary signed URL path confusion (June 8) and a low-severity XSS in the debug page (September 10).

Sources