CVE-2021-43617: laravel framework

csirt@kutim:~/threat-intel/cve/CVE-2021-43617

CVSS 9.8 · Critical EPSS 19,8%

Kerentanan Unrestricted Upload of File with Dangerous Type pada laravel framework. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.

Rincian

Terbit di NVD: 14 November 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-434: Unrestricted Upload of File with Dangerous Type
EPSS (30 hari): 19,8% peluang dieksploitasi; lebih tinggi dari 97,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
laravel	framework	Semua versi hingga 8.70.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://salsa.debian.org/php-team/php/-/blob/dc253886b5b2e9bc8d9e36db787abb083a667fd8/debian/php-cgi.conf#L5-6 patch · advisory pihak ketiga
https://salsa.debian.org/php-team/php/-/commit/dc253886b5b2e9bc8d9e36db787abb083a667fd8 patch · advisory pihak ketiga
https://github.com/laravel/framework/blob/2049de73aa099a113a287587df4cc522c90961f5/src/Illuminate/Validation/C... advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.