{ "@id": "urn:uuid:f63f243e-30fd-4e63-a129-e3215f8fa8cb", "role": "Document Creator", "author": "https://tuxcare.com", "version": 18, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T19:07:00.085664+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.1-p5+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 does not affect Laravel 8.12.1-p5+tuxcare. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017), and the fix was already present in the upstream Laravel 8.12.1 release (December 2020) that TuxCare onboarded. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison, preventing...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 does not affect Laravel 8.12.1-p5+tuxcare. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017), and the fix was already present in the upstream Laravel 8.12.1 release (December 2020) that TuxCare onboarded. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison, preventing..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 8.12.1-p5+tuxcare of laravel/framework. The target Laravel v8.12.1 is NOT affected by CVE-2018-15133. The vulnerability (uncontrolled deserialization of encrypted cookie data) has been mitigated by the upstream Laravel framework prior to v8.12.1. The target code passes `false` to `decrypt()` for all cookie operations, preventing automatic unserialization and blocking PHP object injection attacks. This fix was authored by Taylor Otwell in August 2018 and was included in the upstream v8.12.1 release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "The target Laravel v8.12.1 is NOT affected by CVE-2018-15133. The vulnerability (uncontrolled deserialization of encrypted cookie data) has been mitigated by the upstream Laravel framework prior to v8.12.1. The target code passes `false` to `decrypt()` for all cookie operations, preventing automatic unserialization and blocking PHP object injection attacks. This fix was authored by Taylor Otwell in August 2018 and was included in the upstream v8.12.1 release that TuxCare onboarded." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.1-p5+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 8.12.1-p5+tuxcare of laravel/framework. The target Laravel Framework 8.12.1 is NOT AFFECTED by CVE-2020-19316. The vulnerable code pattern (unescaped shell parameters in the link() method's mklink exec call) is not present. The target has the proper fix with escapeshellarg() sanitization on both $link and $target parameters (line 320 of Filesystem.php). This fix was authored by upstream Laravel maintainer Taylor Otwell in May 2019 (commit 44c3feb604944599ad1c782a9942981c3991fa31) and was already present in the upstream Laravel 8.12.1 release when TuxCare onboarded it via snapshot commit 4993dfe2ac. CVE affected versions \"before 5.8.17\"; target is 8.12.1, which naturally includes the fix from the 5.8.17 era.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "The target Laravel Framework 8.12.1 is NOT AFFECTED by CVE-2020-19316. The vulnerable code pattern (unescaped shell parameters in the link() method's mklink exec call) is not present. The target has the proper fix with escapeshellarg() sanitization on both $link and $target parameters (line 320 of Filesystem.php). This fix was authored by upstream Laravel maintainer Taylor Otwell in May 2019 (commit 44c3feb604944599ad1c782a9942981c3991fa31) and was already present in the upstream Laravel 8.12.1 release when TuxCare onboarded it via snapshot commit 4993dfe2ac. CVE affected versions \"before 5.8.17\"; target is 8.12.1, which naturally includes the fix from the 5.8.17 era." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:41:10.796701+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 8.12.1-p5+tuxcare of laravel/framework. Laravel 8.12.1 was released after CVE-2020-24941 was fixed upstream. The vulnerability affected Laravel <6.18.35 and 7.x <7.24.0. The fix (commit 897d107) was applied on August 7, 2020, before Laravel 8.0's September 2020 release. Version 8.12.1 shipped with the fix already present: the isGuardableColumn() method validates attribute keys against actual database columns, preventing the JSON column nesting bypass. The vulnerable pattern (stripping '->' before guard checks) is not present. This is an upstream fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "Laravel 8.12.1 was released after CVE-2020-24941 was fixed upstream. The vulnerability affected Laravel <6.18.35 and 7.x <7.24.0. The fix (commit 897d107) was applied on August 7, 2020, before Laravel 8.0's September 2020 release. Version 8.12.1 shipped with the fix already present: the isGuardableColumn() method validates attribute keys against actual database columns, preventing the JSON column nesting bypass. The vulnerable pattern (stripping '->' before guard checks) is not present. This is an upstream fix, not a TuxCare backport." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.1-p5+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.1-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer that uses Tippy.js tooltips with allowHTML enabled. Laravel 8.x uses a completely different exception rendering system (Whoops library from filp/whoops) and does not contain the vulnerable code. The Tippy.js-based exception renderer infrastructure does not exist in this versio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer that uses Tippy.js tooltips with allowHTML enabled. Laravel 8.x uses a completely different exception rendering system (Whoops library from filp/whoops) and does not contain the vulnerable code. The Tippy.js-based exception renderer infrastructure does not exist in this versio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.1-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 11/12. Version 8.12.1 predates this feature entirely - it only has basic JsonResource with no include parameter processing or relationship compilation logic. The entire vulnerable code path is absent f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 11/12. Version 8.12.1 predates this feature entirely - it only has basic JsonResource with no include parameter processing or relationship compilation logic. The entire vulnerable code path is absent f..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-11-04T11:38:00.180821+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.1-p5+tuxcare of laravel/framework, and is fixed in 8.12.1-p6+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.1-p5+tuxcare of laravel/framework, and is fixed in 8.12.1-p6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-11-13T19:07:00.085664+00:00", "status_notes": "Vulnerability CVE-2026-128083 does not affect version 8.12.1-p5+tuxcare of laravel/framework. not_affected \u2014 Target is laravel/framework 8.12.1-p6+tuxcare. The Illuminate\\Concurrency component (Concurrency::run and its process driver, which parses a child's stdout as a result envelope) does not exist in this version. It was added in the 11.x/12.x/13.x line (git history shows \"Add illuminate/concurrency subsplit\" in 13.x only). The CVE's vulnerable component is absent, so the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-128083" }, "impact_statement": "not_affected \u2014 Target is laravel/framework 8.12.1-p6+tuxcare. The Illuminate\\Concurrency component (Concurrency::run and its process driver, which parses a child's stdout as a result envelope) does not exist in this version. It was added in the 11.x/12.x/13.x line (git history shows \"Add illuminate/concurrency subsplit\" in 13.x only). The CVE's vulnerable component is absent, so the target is not affected." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-28T20:53:45.635911+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.1-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via unsafe cookie deserialization). The vulnerability affected Laravel 5.6.x prior to 5.6.30 and was fixed in August 2018 by disabling cookie serialization. Laravel 8.12.1 (released December 2020) already contains the fix in its upstream release: `protected static $serialize = false` in EncryptCookies.php globally disab...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via unsafe cookie deserialization). The vulnerability affected Laravel 5.6.x prior to 5.6.30 and was fixed in August 2018 by disabling cookie serialization. Laravel 8.12.1 (released December 2020) already contains the fix in its upstream release: `protected static $serialize = false` in EncryptCookies.php globally disab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.1-p5+tuxcare of laravel/framework. not_affected \u2014 The Laravel Encrypter IV length validation vulnerability (GHSA-7852-w36x-6mf6) is NOT present in this target. The fix was included in upstream Laravel 8.12.1 (released December 2020) and imported via snapshot commit 4993dfe2ac. The validPayload method at lines 211-215 of src/Illuminate/Encryption/Encrypter.php contains the exact IV length validation (line 214: strlen(base64_decode($payload['iv'...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The Laravel Encrypter IV length validation vulnerability (GHSA-7852-w36x-6mf6) is NOT present in this target. The fix was included in upstream Laravel 8.12.1 (released December 2020) and imported via snapshot commit 4993dfe2ac. The validPayload method at lines 211-215 of src/Illuminate/Encryption/Encrypter.php contains the exact IV length validation (line 214: strlen(base64_decode($payload['iv'..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.1-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns ambiguous URL parsing in local filesystem temporary signed URLs, but Laravel 8.x does not have the local filesystem signed URL feature. The temporaryUrl() method throws RuntimeException for local storage adapters. This feature was introduced in Laravel 11+/12.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns ambiguous URL parsing in local filesystem temporary signed URLs, but Laravel 8.x does not have the local filesystem signed URL feature. The temporaryUrl() method throws RuntimeException for local storage adapters. This feature was introduced in Laravel 11+/12.x." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-31T20:14:30.754022+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 8.12.1-p5+tuxcare of laravel/framework. Target version 8.12.1-p5+tuxcare is NOT AFFECTED. The encryption oracle vulnerability (GHSA-qm5c-m76r-2hfr) was fixed in upstream Laravel framework on July 27, 2020, when Taylor Otwell replaced the unkeyed sha1() cookie prefix with a keyed HMAC via the CookieValuePrefix class. Laravel 8.12.1 was released November 5, 2020, four months AFTER the fix, so the vulnerable pattern is not present in the onboarded upstream release. The target uses CookieValuePrefix::create() with hash_hmac('sha1', $cookieName.'v2', $key), making cookie prefixes unforgeable without the encryption key.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Target version 8.12.1-p5+tuxcare is NOT AFFECTED. The encryption oracle vulnerability (GHSA-qm5c-m76r-2hfr) was fixed in upstream Laravel framework on July 27, 2020, when Taylor Otwell replaced the unkeyed sha1() cookie prefix with a keyed HMAC via the CookieValuePrefix class. Laravel 8.12.1 was released November 5, 2020, four months AFTER the fix, so the vulnerable pattern is not present in the onboarded upstream release. The target uses CookieValuePrefix::create() with hash_hmac('sha1', $cookieName.'v2', $key), making cookie prefixes unforgeable without the encryption key." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p5+tuxcare" } } ], "timestamp": "2026-10-14T14:42:00.059944+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.1-p5+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } } ] }