CVE-2026-48019
highLaravel is a web application framework.
Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patched in versions 12.60.0 and 13.10.0.
CVSS
8.9
8.9 (CVSS v3.1)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L Severity source: NVD CVSS v3.1 (security-advisories@github.com)
Timeline (UTC)
Published: 2026-09-04 23:17
Modified: 2026-09-10 20:41
NVD status: Awaiting Analysis
Last synced 1 day ago
Verified against the source API 2026-10-27 06:50 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/laravel/framework/commit/96e9a663db657cf37ef26cd794fda8ff60eaa451 security-advisories@github.com
- https://github.com/laravel/framework/commit/f336ba79e744257f84ebf0d096b0ebc62e8e1a4d security-advisories@github.com
- https://github.com/laravel/framework/pull/60151 security-advisories@github.com
- https://github.com/laravel/framework/releases/tag/v12.60.0 security-advisories@github.com
- https://github.com/laravel/framework/releases/tag/v13.10.0 security-advisories@github.com
- https://github.com/laravel/framework/security/advisories/GHSA-5vg9-5847-vvmq security-advisories@github.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:50 UTC · record ↗