What is GHSA-78fx-h6xr-vch4?

GHSA-78fx-h6xr-vch4 is a security advisory published by GitHub Security Advisories with Medium severity. Laravel has a File Validation Bypass

Which CVE IDs does GHSA-78fx-h6xr-vch4 cover?

GHSA-78fx-h6xr-vch4 covers the following CVE IDs: CVE-2025-27515. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-78fx-h6xr-vch4?

GHSA-78fx-h6xr-vch4 affects 3 products, including: composer/laravel/framework:\u003e= 12.0.0, \u003c 12.1.1; composer/laravel/framework:\u003e= 11.0.0, \u003c 11.44.1; composer/laravel/framework:\u003c 10.48.29.

GHSA-78fx-h6xr-vch4Medium

Laravel has a File Validation Bypass

Vendor

GitHub Security Advisories

Published

March 5, 2025

Last Modified

March 12, 2025

🔗 CVE IDs covered (1)

CVE-2025-27515 →

📋 Description

When using wildcard validation to validate a given file or image field array (files.*), a user-crafted malicious request could potentially bypass the validation rules.

🎯 Affected products3

composer/laravel/framework:>= 12.0.0, < 12.1.1
composer/laravel/framework:>= 11.0.0, < 11.44.1
composer/laravel/framework:< 10.48.29

🔗 References (5)

https://github.com/laravel/framework/security/advisories/GHSA-78fx-h6xr-vch4
https://github.com/laravel/framework/commit/2d133034fefddfb047838f4caca3687a3ba811a5
https://nvd.nist.gov/vuln/detail/CVE-2025-27515
https://github.com/laravel/framework/commit/a4f7a8f9b83e21882abeef78c3174c66b0f4a26b
https://github.com/advisories/GHSA-78fx-h6xr-vch4