{
  "@id": "urn:uuid:f932e2cf-de86-47d7-8eb8-3432f8c8d175",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 18,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T19:07:00.085664+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-12T07:00:11.552617+00:00",
      "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 5.8.38-p7+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "AIKIDO-2026-10659"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T23:14:38.175256+00:00",
      "status_notes": "Vulnerability CVE-2017-14775 does not affect version 5.8.38-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-14775"
      },
      "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:45:11.789246+00:00",
      "status_notes": "Vulnerability CVE-2018-15133 does not affect version 5.8.38-p7+tuxcare of laravel/framework. The target (Laravel 5.8.38) is not affected by CVE-2018-15133. The vulnerability was fixed upstream by Taylor Otwell in August 2018 by disabling PHP serialization for cookies and the X-XSRF-TOKEN header. Laravel 5.8.38 shipped with this fix already applied. The fix prevents PHP object injection by passing `false` to encrypt()/decrypt() methods, which disables automatic unserialize() calls on decrypted data. The vulnerable code pattern (automatic unserialization enabling RCE via crafted XSRF tokens) is not present in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-15133"
      },
      "impact_statement": "The target (Laravel 5.8.38) is not affected by CVE-2018-15133. The vulnerability was fixed upstream by Taylor Otwell in August 2018 by disabling PHP serialization for cookies and the X-XSRF-TOKEN header. Laravel 5.8.38 shipped with this fix already applied. The fix prevents PHP object injection by passing `false` to encrypt()/decrypt() methods, which disables automatic unserialize() calls on decrypted data. The vulnerable code pattern (automatic unserialization enabling RCE via crafted XSRF tokens) is not present in this version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-19T13:14:00.236705+00:00",
      "status_notes": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.8.38-p7+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19).",
      "vulnerability": {
        "name": "CVE-2019-9081"
      },
      "impact_statement": "CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T20:43:15.621975+00:00",
      "status_notes": "Vulnerability CVE-2020-19316 does not affect version 5.8.38-p7+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before 5.8.17. The target is version 5.8.38-p8+tuxcare, which already contains the upstream fix. The vulnerability was an OS command injection in the link() function where unescaped $link and $target parameters were interpolated into an exec() call. The fix wraps both parameters with escapeshellarg() before shell execution. This fix was already present in the upstream Laravel 5.8.38 release and was imported via the Initial commit when TuxCare onboarded this version. The vulnerable code pattern is not present in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-19316"
      },
      "impact_statement": "CVE-2020-19316 affects Laravel Framework before 5.8.17. The target is version 5.8.38-p8+tuxcare, which already contains the upstream fix. The vulnerability was an OS command injection in the link() function where unescaped $link and $target parameters were interpolated into an exec() call. The fix wraps both parameters with escapeshellarg() before shell execution. This fix was already present in the upstream Laravel 5.8.38 release and was imported via the Initial commit when TuxCare onboarded this version. The vulnerable code pattern is not present in the target."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-12T07:00:11.552617+00:00",
      "status_notes": "Vulnerability CVE-2020-24941 is fixed in version 5.8.38-p7+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "CVE-2020-24941"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T18:16:23.572849+00:00",
      "status_notes": "Vulnerability CVE-2021-21263 affects version 5.8.38-p7+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "CVE-2021-21263"
      },
      "action_statement": "Vulnerability CVE-2021-21263 affects version 5.8.38-p7+tuxcare of laravel/framework."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.8.38-p7+tuxcare.",
      "vulnerability": {
        "name": "CVE-2021-43617"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-12T07:00:11.552617+00:00",
      "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 5.8.38-p7+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "CVE-2021-43808"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-12T07:00:11.552617+00:00",
      "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 5.8.38-p7+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "CVE-2024-52301"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-12T07:00:11.552617+00:00",
      "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 5.8.38-p7+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "CVE-2025-27515"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-12T07:00:11.552617+00:00",
      "status_notes": "Vulnerability CVE-2026-102279 does not affect version 5.8.38-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-102279"
      },
      "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T00:51:30.888148+00:00",
      "status_notes": "Vulnerability CVE-2026-114508 does not affect version 5.8.38-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-114508"
      },
      "impact_statement": "not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-04T12:52:00.536685+00:00",
      "status_notes": "Vulnerability CVE-2026-114509 affects version 5.8.38-p7+tuxcare of laravel/framework, and is fixed in 5.8.38-p9+tuxcare.",
      "vulnerability": {
        "name": "CVE-2026-114509"
      },
      "action_statement": "Vulnerability CVE-2026-114509 affects version 5.8.38-p7+tuxcare of laravel/framework, and is fixed in 5.8.38-p9+tuxcare."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-13T19:07:00.085664+00:00",
      "status_notes": "Vulnerability CVE-2026-128083 does not affect version 5.8.38-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 has no Concurrency component (Concurrency::run, ProcessDriver, invoke-serialized-closure). The vulnerable feature was added in much later releases (Laravel 11 era, patched in 12.71.0 and 13.40.0). The target has no code that spawns child processes and parses their stdout as a trusted serialized result.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-128083"
      },
      "impact_statement": "not_affected \u2014 Laravel 5.8.38 has no Concurrency component (Concurrency::run, ProcessDriver, invoke-serialized-closure). The vulnerable feature was added in much later releases (Laravel 11 era, patched in 12.71.0 and 13.40.0). The target has no code that spawns child processes and parses their stdout as a trusted serialized result."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-12T07:00:11.552617+00:00",
      "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.8.38-p7+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "GHSA-4mg9-vhxq-vm7j"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-12T07:00:11.552617+00:00",
      "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 5.8.38-p7+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "GHSA-5vg9-5847-vvmq"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T21:00:11.359241+00:00",
      "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.8.38-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-6jvx-8ch9-j2jr"
      },
      "impact_statement": "not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T23:07:07.266705+00:00",
      "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.8.38-p7+tuxcare of laravel/framework. not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-7852-w36x-6mf6"
      },
      "impact_statement": "not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-12T07:00:11.552617+00:00",
      "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.8.38-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-crmm-hgp2-wgrp"
      },
      "impact_statement": "not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T18:14:49.853815+00:00",
      "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p7+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "GHSA-jwvj-pwww-3mj5"
      },
      "action_statement": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p7+tuxcare of laravel/framework."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-12T07:00:11.552617+00:00",
      "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.8.38-p7+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "GHSA-qm5c-m76r-2hfr"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T18:16:23.572849+00:00",
      "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p7+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "GHSA-wq8p-mqvg-2p5h"
      },
      "action_statement": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p7+tuxcare of laravel/framework."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare",
          "identifiers": {
            "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-12T07:00:11.552617+00:00",
      "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.8.38-p7+tuxcare of laravel/framework.",
      "vulnerability": {
        "name": "GHSA-x7p5-p2c9-phvg"
      }
    }
  ]
}