CVE-2026-48019
CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay
En bref
- Sévérité
- HIGH 8.9
- EPSS
- EPSS 0.51 % · centile 43 (2026-10-27)
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- GitHub_M
- Statut NVD
- Awaiting Analysis
Description
Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patched in versions 12.60.0 and 13.10.0.
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L | GitHub_M |
| CVSS 3.1 | HIGH 8.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L | NVD · security-advisories@github.com (Secondary) |
Faiblesses (CWE)
Avis
- GHSA-5vg9-5847-vvmq — Laravel Framework: CRLF injection in default email rule
Références européennes
- ENISA EUVD · EUVD-2026-71787
- GCVE · GCVE-0-2026-48019
Avis du CERT-FR
- CERTFR-2026-AVI-0670 — Vulnérabilité dans Laravel · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| laravel · framework | affected >= 13.0.0, < 13.10.0 ; affected < 12.60.0 |
Références
- https://github.com/laravel/framework/security/advisories/GHSA-5vg9-5847-vvmq
- https://github.com/laravel/framework/pull/60151
- https://github.com/laravel/framework/commit/96e9a663db657cf37ef26cd794fda8ff60eaa451
- https://github.com/laravel/framework/commit/f336ba79e744257f84ebf0d096b0ebc62e8e1a4d
- https://github.com/laravel/framework/releases/tag/v12.60.0
- https://github.com/laravel/framework/releases/tag/v13.10.0
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |