- Vendor / Project
- Laravel
- Product
- Ignition
- Date added
- Sep 18, 2023
- Due date
- Oct 9, 2023
- Known ransomware use
- Known
- CWEs
- —
Description
Laravel Ignition contains a file upload vulnerability that allows unauthenticated remote attackers to execute malicious code due to insecure usage of file_get_contents() and file_put_contents().
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.