{ "@id": "urn:uuid:49016884-bdbc-4787-be50-228ee8adc477", "role": "Document Creator", "author": "https://tuxcare.com", "version": 23, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T19:00:35.353264+00:00", "statements": [ { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-01T15:26:55.316610+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 12.58.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 12.58.0-p4+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 concerns timing side-channel attacks in Laravel's remember_me token verification due to variable-time string comparison. The target repository (Laravel 12.58.0-p6+tuxcare) contains the fix: both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() for token comparison. The vulnerability pattern (SQL WHERE clause string comparison) is not present. The fix ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 concerns timing side-channel attacks in Laravel's remember_me token verification due to variable-time string comparison. The target repository (Laravel 12.58.0-p6+tuxcare) contains the fix: both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() for token comparison. The vulnerability pattern (SQL WHERE clause string comparison) is not present. The fix ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 12.58.0-p4+tuxcare of laravel/framework. CVE-2018-15133 describes remote code execution via unsafe PHP object deserialization when decrypting X-XSRF-TOKEN cookies. The vulnerability required the attacker to know the application encryption key and craft a malicious serialized object payload. Laravel Framework fixed this in August 2018 by disabling PHP object serialization during cookie encryption/decryption (setting $serialize=false by default). The target repository (laravel/framework version 12.58.0-p6+tuxcare) contains the complete vendor fix, which was shipped in the upstream Laravel v12.58.0 release and imported via TuxCare snapshot commit 85d8011ca6. The vulnerable pattern (unsafe unserialize() calls on cookie data) is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 describes remote code execution via unsafe PHP object deserialization when decrypting X-XSRF-TOKEN cookies. The vulnerability required the attacker to know the application encryption key and craft a malicious serialized object payload. Laravel Framework fixed this in August 2018 by disabling PHP object serialization during cookie encryption/decryption (setting $serialize=false by default). The target repository (laravel/framework version 12.58.0-p6+tuxcare) contains the complete vendor fix, which was shipped in the upstream Laravel v12.58.0 release and imported via TuxCare snapshot commit 85d8011ca6. The vulnerable pattern (unsafe unserialize() calls on cookie data) is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 12.58.0-p4+tuxcare of laravel/framework. CVE-2019-9081 describes a PHP object injection gadget chain in PendingCommand's __destruct method. While this gadget chain exists in version 12.58.0, the framework itself does not provide any production code path where user-controllable serialized data is unserialized and could trigger this gadget. PendingCommand is a testing utility instantiated only in test contexts. Laravel's production serialization (sessions, cookies, cache) uses encrypted/signed data or server-side storage, preventing arbitrary payload injection. The framework is not vulnerable when used as designed; exploitation requires downstream applications to explicitly unserialize untrusted user data without restrictions, which constitutes an application-level vulnerability, not a framework vulnerability.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "CVE-2019-9081 describes a PHP object injection gadget chain in PendingCommand's __destruct method. While this gadget chain exists in version 12.58.0, the framework itself does not provide any production code path where user-controllable serialized data is unserialized and could trigger this gadget. PendingCommand is a testing utility instantiated only in test contexts. Laravel's production serialization (sessions, cookies, cache) uses encrypted/signed data or server-side storage, preventing arbitrary payload injection. The framework is not vulnerable when used as designed; exploitation requires downstream applications to explicitly unserialize untrusted user data without restrictions, which constitutes an application-level vulnerability, not a framework vulnerability." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 12.58.0-p4+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before v5.8.17 (May 2019). The target repository is Laravel Framework v12.58.0 (released late 2024), which already contains the upstream fix. The vulnerable code pattern (unescaped shell parameters in the link() method) is not present. Both exec() calls at lines 358 and 364 in src/Illuminate/Filesystem/Filesystem.php properly use escapeshellarg() on the $target and $link parameters, preventing OS command injection. This fix was shipped in the upstream v12.58.0 release that TuxCare imported via snapshot commit 85d8011ca6, not added as a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before v5.8.17 (May 2019). The target repository is Laravel Framework v12.58.0 (released late 2024), which already contains the upstream fix. The vulnerable code pattern (unescaped shell parameters in the link() method) is not present. Both exec() calls at lines 358 and 364 in src/Illuminate/Filesystem/Filesystem.php properly use escapeshellarg() on the $target and $link parameters, preventing OS command injection. This fix was shipped in the upstream v12.58.0 release that TuxCare imported via snapshot commit 85d8011ca6, not added as a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:41:57.354813+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 12.58.0-p4+tuxcare of laravel/framework. The target Laravel 12.58.0 is not affected by CVE-2020-24941. The vulnerability affected Laravel before 6.18.35 and 7.x before 7.24.0, where the $guarded property could be bypassed using JSON column nesting expressions or non-existent column names. The upstream fix (commit 897d107775, authored by Taylor Otwell on 2020-08-07) introduced the isGuardableColumn() method that validates attribute keys against actual database columns. This fix has been part of Laravel's codebase for years and was already present in the upstream v12.58.0 release that TuxCare onboarded in May 2026. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target Laravel 12.58.0 is not affected by CVE-2020-24941. The vulnerability affected Laravel before 6.18.35 and 7.x before 7.24.0, where the $guarded property could be bypassed using JSON column nesting expressions or non-existent column names. The upstream fix (commit 897d107775, authored by Taylor Otwell on 2020-08-07) introduced the isGuardableColumn() method that validates attribute keys against actual database columns. This fix has been part of Laravel's codebase for years and was already present in the upstream v12.58.0 release that TuxCare onboarded in May 2026. The vulnerable code pattern is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 12.58.0-p4+tuxcare of laravel/framework. Laravel v12.58.0 is not affected by CVE-2021-21263. The upstream release already contains the flattenValue() method which provides equivalent protection to the security patch. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) normalize array inputs to scalars before adding query bindings, preventing the query binding exploitation described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "Laravel v12.58.0 is not affected by CVE-2021-21263. The upstream release already contains the flattenValue() method which provides equivalent protection to the security patch. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) normalize array inputs to scalars before adding query bindings, preventing the query binding exploitation described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:27:55.132553+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 12.58.0-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 12.58.0-p6+tuxcare is NOT AFFECTED by CVE-2021-43808. The vulnerability (predictable parent placeholder hash enabling XSS via placeholder injection) is not present because the fix was already included in the upstream Laravel 12.58.0 release that TuxCare onboarded. The target code contains the security mitigation: random per-request salt in parent placeholder generation (ManagesLayouts.p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 Laravel 12.58.0-p6+tuxcare is NOT AFFECTED by CVE-2021-43808. The vulnerability (predictable parent placeholder hash enabling XSS via placeholder injection) is not present because the fix was already included in the upstream Laravel 12.58.0 release that TuxCare onboarded. The target code contains the security mitigation: random per-request salt in parent placeholder generation (ManagesLayouts.p..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 12.58.0-p4+tuxcare of laravel/framework. CVE-2024-52301 (environment manipulation via query string) is NOT present in Laravel Framework v12.58.0-p6+tuxcare. The vulnerable pattern (unconditional use of $_SERVER['argv'] for environment detection) has been replaced with a SAPI-based guard that blocks web requests from using argv values. The fix was authored by Taylor Otwell and shipped in upstream Laravel v12.58.0 before TuxCare snapshotted this version. The current code at Application.php:791 checks runningInConsole() (which validates PHP_SAPI === 'cli') before accessing argv, preventing attackers from manipulating the framework environment via crafted query strings when register_argc_argv is enabled.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "CVE-2024-52301 (environment manipulation via query string) is NOT present in Laravel Framework v12.58.0-p6+tuxcare. The vulnerable pattern (unconditional use of $_SERVER['argv'] for environment detection) has been replaced with a SAPI-based guard that blocks web requests from using argv values. The fix was authored by Taylor Otwell and shipped in upstream Laravel v12.58.0 before TuxCare snapshotted this version. The current code at Application.php:791 checks runningInConsole() (which validates PHP_SAPI === 'cli') before accessing argv, preventing attackers from manipulating the framework environment via crafted query strings when register_argc_argv is enabled." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T22:05:48.947173+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 12.58.0-p4+tuxcare of laravel/framework. not_affected \u2014 The target (Laravel framework v12.58.0-p6+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel v12.58.0 release that TuxCare imported. The fix prevents wildcard validation bypass by preserving placeholder-encoded attribute names when validating File, Email, and Password rules, ensuring malicious array keys (like '.', '*', '__asterisk__') ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 The target (Laravel framework v12.58.0-p6+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel v12.58.0 release that TuxCare imported. The fix prevents wildcard validation bypass by preserving placeholder-encoded attribute names when validating File, Email, and Password rules, ensuring malicious array keys (like '.', '*', '__asterisk__') ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-01T15:26:55.316610+00:00", "status_notes": "Vulnerability CVE-2026-102279 is fixed in version 12.58.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-102279" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-30T08:47:11.256466+00:00", "status_notes": "Vulnerability CVE-2026-114508 affects version 12.58.0-p4+tuxcare of laravel/framework, and is fixed in 12.58.0-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-114508" }, "action_statement": "Vulnerability CVE-2026-114508 affects version 12.58.0-p4+tuxcare of laravel/framework, and is fixed in 12.58.0-p7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T12:31:25.113305+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 12.58.0-p4+tuxcare of laravel/framework, and is fixed in 12.58.0-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 12.58.0-p4+tuxcare of laravel/framework, and is fixed in 12.58.0-p6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-11-13T19:00:35.353264+00:00", "status_notes": "Vulnerability CVE-2026-128083 affects version 12.58.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-128083" }, "action_statement": "Vulnerability CVE-2026-128083 affects version 12.58.0-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:49:09.974795+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 12.58.0-p4+tuxcare of laravel/framework. not_affected \u2014 GHSA-4mg9-vhxq-vm7j describes SQL injection when user input is passed to Laravel's limit/offset functions on SQL Server connections. The vulnerability was patched in Laravel 8.40.0 (May 2021) by adding integer casting to these methods. The target version (Laravel 12.58.0-p6+tuxcare) already contains the upstream fix: Builder->limit() casts to (int) at line 3115, and Builder->offset() casts at l...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 GHSA-4mg9-vhxq-vm7j describes SQL injection when user input is passed to Laravel's limit/offset functions on SQL Server connections. The vulnerability was patched in Laravel 8.40.0 (May 2021) by adding integer casting to these methods. The target version (Laravel 12.58.0-p6+tuxcare) already contains the upstream fix: Builder->limit() casts to (int) at line 3115, and Builder->offset() casts at l..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-01T15:26:55.316610+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 12.58.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 12.58.0-p4+tuxcare of laravel/framework. not_affected \u2014 Target version 12.58.0 is NOT AFFECTED by GHSA-6jvx-8ch9-j2jr (PHP object injection via serialized cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018), and version 12.58.0 (2025) is 7 years newer. The fix disables PHP serialization for all cookies by setting static::$serialize = false, preventing unserialization of attacker-controlled cookie data and blocking the path to arbit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Target version 12.58.0 is NOT AFFECTED by GHSA-6jvx-8ch9-j2jr (PHP object injection via serialized cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018), and version 12.58.0 (2025) is 7 years newer. The fix disables PHP serialization for all cookies by setting static::$serialize = false, preventing unserialization of attacker-controlled cookie data and blocking the path to arbit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 12.58.0-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v12.58.0-p6+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decrypt to return false instead of throwing exception) has been fixed by upstream Laravel. The fix validates that base64-decoded IV length matches the expected cipher IV length (line 272: `strlen(base64_decode($payload['iv'], true)) === op...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel framework v12.58.0-p6+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decrypt to return false instead of throwing exception) has been fixed by upstream Laravel. The fix validates that base64-decoded IV length matches the expected cipher IV length (line 272: `strlen(base64_decode($payload['iv'], true)) === op..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-01T15:26:55.316610+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp is fixed in version 12.58.0-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:16:19.887305+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 12.58.0-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 12.58.0 is not affected by GHSA-jwvj-pwww-3mj5 (unexpected query bindings from array values). The vulnerability was fixed in upstream Laravel 6.x in January 2021, and the fix was already present in Laravel 12.58.0 when TuxCare onboarded it. All query builder methods covered by the security patches (where, whereBetween, having, havingBetween, whereDate, where...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel framework version 12.58.0 is not affected by GHSA-jwvj-pwww-3mj5 (unexpected query bindings from array values). The vulnerability was fixed in upstream Laravel 6.x in January 2021, and the fix was already present in Laravel 12.58.0 when TuxCare onboarded it. All query builder methods covered by the security patches (where, whereBetween, having, havingBetween, whereDate, where..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:18:00.235397+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 12.58.0-p4+tuxcare of laravel/framework. The target Laravel framework v12.58.0 is not affected by GHSA-qm5c-m76r-2hfr. The vulnerability (predictable SHA1-based cookie prefixes enabling encryption oracle attacks) was fixed in upstream Laravel 6.18.31 (July 2020). The fix uses HMAC-SHA1 with the secret key instead of plain SHA1, preventing attackers from crafting valid cookie prefixes. This fix was already present in the upstream Laravel 12.58.0 release that TuxCare onboarded, making the vulnerable code pattern absent from the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel framework v12.58.0 is not affected by GHSA-qm5c-m76r-2hfr. The vulnerability (predictable SHA1-based cookie prefixes enabling encryption oracle attacks) was fixed in upstream Laravel 6.18.31 (July 2020). The fix uses HMAC-SHA1 with the secret key instead of plain SHA1, preventing attackers from crafting valid cookie prefixes. This fix was already present in the upstream Laravel 12.58.0 release that TuxCare onboarded, making the vulnerable code pattern absent from the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 12.58.0-p4+tuxcare of laravel/framework. not_affected \u2014 The target repository (laravel/framework 12.58.0-p6+tuxcare) is not affected by GHSA-wq8p-mqvg-2p5h. The SQL Server SQL injection vulnerability in limit/offset functions was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Version 12.58.0 already contains all required integer casting and validation protections in both SqlServerGrammar.php and Builder.php. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 The target repository (laravel/framework 12.58.0-p6+tuxcare) is not affected by GHSA-wq8p-mqvg-2p5h. The SQL Server SQL injection vulnerability in limit/offset functions was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Version 12.58.0 already contains all required integer casting and validation protections in both SqlServerGrammar.php and Builder.php. ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@12.58.0-p4+tuxcare" } } ], "timestamp": "2026-10-31T20:41:57.354813+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 12.58.0-p4+tuxcare of laravel/framework. Laravel framework v12.58.0 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability affects Laravel 6.x (patched January 2021) where array values passed to query builder methods could inject unexpected bindings. The current version 12.58.0 already includes upstream protection via the flattenValue() helper method, which flattens array inputs to scalar values before binding. All 10 affected methods (where, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, whereBetween, havingBetween) use this protection. The fix was present in the upstream Laravel v12.58.0 release imported during onboarding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "Laravel framework v12.58.0 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability affects Laravel 6.x (patched January 2021) where array values passed to query builder methods could inject unexpected bindings. The current version 12.58.0 already includes upstream protection via the flattenValue() helper method, which flattens array inputs to scalar values before binding. All 10 affected methods (where, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, whereBetween, havingBetween) use this protection. The fix was present in the upstream Laravel v12.58.0 release imported during onboarding." } ] }