{ "@id": "urn:uuid:00fcebef-36ef-4133-b2b4-44c4be349ce9", "role": "Document Creator", "author": "https://tuxcare.com", "version": 20, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T19:07:00.085664+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.0-p3+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 8.12.0 is NOT AFFECTED by CVE-2017-14775. The vulnerability (timing attack on remember_me token verification via database string comparison) is not present. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison. The fix was shipped in upstream Laravel 5.5.10 (September 2017) and is present in Laravel 8.12.0, which TuxCare onboarde...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Target Laravel 8.12.0 is NOT AFFECTED by CVE-2017-14775. The vulnerability (timing attack on remember_me token verification via database string comparison) is not present. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison. The fix was shipped in upstream Laravel 5.5.10 (September 2017) and is present in Laravel 8.12.0, which TuxCare onboarde..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.12.0-p3+tuxcare of laravel/framework. Laravel Framework v8.12.0 is not affected by CVE-2018-15133. The vulnerability involved unserialize being called on untrusted X-XSRF-TOKEN cookie values, enabling remote code execution. The upstream fix (disabling serialization for cookie encryption/decryption) was already present in Laravel v8.12.0 when TuxCare onboarded this version. The fix was originally applied by Taylor Otwell in August 2018 (commits c0eb9073, 7c90d413, 97467e3c, 240d9046), well before the v8.x release line.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "Laravel Framework v8.12.0 is not affected by CVE-2018-15133. The vulnerability involved unserialize being called on untrusted X-XSRF-TOKEN cookie values, enabling remote code execution. The upstream fix (disabling serialization for cookie encryption/decryption) was already present in Laravel v8.12.0 when TuxCare onboarded this version. The fix was originally applied by Taylor Otwell in August 2018 (commits c0eb9073, 7c90d413, 97467e3c, 240d9046), well before the v8.x release line." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.0-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.12.0-p3+tuxcare of laravel/framework. CVE-2020-19316 command injection vulnerability is NOT present in Laravel Framework 8.12.0-p7+tuxcare. The vulnerable pattern (unescaped shell parameters in exec() call) does not exist. The fix (escapeshellarg() wrapping) was already present in upstream Laravel v8.12.0 when TuxCare onboarded it. File src/Illuminate/Filesystem/Filesystem.php line 320 correctly applies escapeshellarg() to both $link and $target parameters before passing them to exec(). Original upstream fix by Taylor Otwell (May 2019, commit 44c3feb604) shipped in Laravel 8.12.0 release (~Nov 2020), 18 months before TuxCare onboarding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 command injection vulnerability is NOT present in Laravel Framework 8.12.0-p7+tuxcare. The vulnerable pattern (unescaped shell parameters in exec() call) does not exist. The fix (escapeshellarg() wrapping) was already present in upstream Laravel v8.12.0 when TuxCare onboarded it. File src/Illuminate/Filesystem/Filesystem.php line 320 correctly applies escapeshellarg() to both $link and $target parameters before passing them to exec(). Original upstream fix by Taylor Otwell (May 2019, commit 44c3feb604) shipped in Laravel 8.12.0 release (~Nov 2020), 18 months before TuxCare onboarding." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:40:50.094173+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.12.0-p3+tuxcare of laravel/framework. The target Laravel 8.12.0-p7+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability fix was already present in the upstream Laravel 8.12.0 release. The affected code (GuardsAttributes.php) contains the complete patched version with isGuardableColumn() validation that blocks mass assignment to non-existent columns. The TuxCare snapshot commit (9014f5a2) simply onboarded the already-fixed upstream release; no backport was needed. CVE affected versions before 6.18.35 and 7.x before 7.24.0; Laravel 8.12.0 is post-fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target Laravel 8.12.0-p7+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability fix was already present in the upstream Laravel 8.12.0 release. The affected code (GuardsAttributes.php) contains the complete patched version with isGuardableColumn() validation that blocks mass assignment to non-existent columns. The TuxCare snapshot commit (9014f5a2) simply onboarded the already-fixed upstream release; no backport was needed. CVE affected versions before 6.18.35 and 7.x before 7.24.0; Laravel 8.12.0 is post-fix." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.0-p3+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's modern exception renderer (introduced in Laravel 11.x+) that uses Tippy.js tooltips with allowHTML:true. Laravel 8.12.0 uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture. The vulnerable components (formatted-source.blade.php, renderer/scripts.js, Ti...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's modern exception renderer (introduced in Laravel 11.x+) that uses Tippy.js tooltips with allowHTML:true. Laravel 8.12.0 uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture. The vulnerable components (formatted-source.blade.php, renderer/scripts.js, Ti..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resource feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, Dec 2025), approximately 5 years after version 8.12.0 (Dec 2020). The target version lacks the entire JSON:API resource system, including the vulnerabl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resource feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, Dec 2025), approximately 5 years after version 8.12.0 (Dec 2020). The target version lacks the entire JSON:API resource system, including the vulnerabl..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:40:03.913990+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.0-p3+tuxcare of laravel/framework, and is fixed in 8.12.0-p8+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.0-p3+tuxcare of laravel/framework, and is fixed in 8.12.0-p8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-11-13T19:07:00.085664+00:00", "status_notes": "Vulnerability CVE-2026-128083 does not affect version 8.12.0-p3+tuxcare of laravel/framework. not_affected \u2014 Target is laravel/framework 8.12.0. The CVE concerns the Illuminate\\Concurrency component (Concurrency::run), whose child-process result protocol can be forged. That component does not exist in 8.12.0 (it was added in the 11.x line), so the vulnerable pattern is absent and the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-128083" }, "impact_statement": "not_affected \u2014 Target is laravel/framework 8.12.0. The CVE concerns the Illuminate\\Concurrency component (Concurrency::run), whose child-process result protocol can be forged. That component does not exist in 8.12.0 (it was added in the 11.x line), so the vulnerable pattern is absent and the target is not affected." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq affects version 8.12.0-p3+tuxcare of laravel/framework, and is fixed in 8.12.0-p4+tuxcare.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" }, "action_statement": "Vulnerability GHSA-5vg9-5847-vvmq affects version 8.12.0-p3+tuxcare of laravel/framework, and is fixed in 8.12.0-p4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:52:55.704640+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization via cookies). The upstream Laravel 8.12.0 release already contained the fix with `protected static $serialize = false`, which disables cookie serialization globally. This defense was present in the snapshot commit 9014f5a213 that imported upstream Laravel 8.12.0 into the TuxCare repository, preventing the exploita...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization via cookies). The upstream Laravel 8.12.0 release already contained the fix with `protected static $serialize = false`, which disables cookie serialization globally. This defense was present in the snapshot commit 9014f5a213 that imported upstream Laravel 8.12.0 into the TuxCare repository, preventing the exploita..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.0-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework v8.12.0 is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false instead of throwing exception when IV length is invalid) is not present because the IV length validation fix was already included in the upstream Laravel v8.12.0 release. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the defensive che...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target Laravel Framework v8.12.0 is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false instead of throwing exception when IV length is invalid) is not present because the IV length validation fix was already included in the upstream Laravel v8.12.0 release. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the defensive che..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.0-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0-p3+tuxcare does not have the vulnerable LocalFilesystemAdapter class or local filesystem temporary URL generation feature. The vulnerability exists in Laravel 11+ where LocalFilesystemAdapter was introduced. The target version uses FilesystemAdapter which explicitly rejects temporary URL generation for local filesystem adapters with a RuntimeException.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.0-p3+tuxcare does not have the vulnerable LocalFilesystemAdapter class or local filesystem temporary URL generation feature. The vulnerability exists in Laravel 11+ where LocalFilesystemAdapter was introduced. The target version uses FilesystemAdapter which explicitly rejects temporary URL generation for local filesystem adapters with a RuntimeException." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:13:26.008802+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.12.0-p3+tuxcare of laravel/framework. The target Laravel framework 8.12.0-p7+tuxcare is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (encryption oracle vulnerability). The vulnerable pattern (keyless SHA1 cookie prefix) is not present because the fix was already included in the upstream Laravel 8.12.0 release. The target uses HMAC-based cookie prefixes that incorporate the encryption key, preventing attackers from crafting valid prefixes via encryption oracles.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel framework 8.12.0-p7+tuxcare is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (encryption oracle vulnerability). The vulnerable pattern (keyless SHA1 cookie prefix) is not present because the fix was already included in the upstream Laravel 8.12.0 release. The target uses HMAC-based cookie prefixes that incorporate the encryption key, preventing attackers from crafting valid prefixes via encryption oracles." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.0-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.0-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } } ] }