CVE-2026-48019
CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay
At a glance
- Severity
- HIGH 8.9
- EPSS
- EPSS 0.51 % · percentile 43 (2026-10-27)
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Awaiting Analysis
Description
Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patched in versions 12.60.0 and 13.10.0.
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L | GitHub_M |
| CVSS 3.1 | HIGH 8.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L | NVD · security-advisories@github.com (Secondary) |
Weaknesses (CWE)
Advisories
- GHSA-5vg9-5847-vvmq — Laravel Framework: CRLF injection in default email rule
European references
- ENISA EUVD · EUVD-2026-71787
- GCVE · GCVE-0-2026-48019
CERT-FR advisories
- CERTFR-2026-AVI-0670 — Vulnérabilité dans Laravel · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| laravel · framework | affected >= 13.0.0, < 13.10.0 ; affected < 12.60.0 |
References
- https://github.com/laravel/framework/security/advisories/GHSA-5vg9-5847-vvmq
- https://github.com/laravel/framework/pull/60151
- https://github.com/laravel/framework/commit/96e9a663db657cf37ef26cd794fda8ff60eaa451
- https://github.com/laravel/framework/commit/f336ba79e744257f84ebf0d096b0ebc62e8e1a4d
- https://github.com/laravel/framework/releases/tag/v12.60.0
- https://github.com/laravel/framework/releases/tag/v13.10.0
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |