CVE-2026-48019

HighCVSS 8.9

Published: 04/09/2026(UTC)Updated: 10/09/2026(UTC)Translated: 05/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.68%

50th percentile - higher than 50% of all known CVEs

Summary

Laravel before versions 12.60.0 and 13.10.0 has a CRLF injection vulnerability in email validation, which combined with Symfony Mailer and Symfony Mime handling of certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing. Patched in 12.60.0 and 13.10.0.

Risk Assessment

An attacker can manipulate the content or headers of outgoing emails, potentially leading to phishing, malware distribution, or reputational damage. The vulnerability can be exploited without authentication.

Recommendation

Upgrade Laravel to version 12.60.0 or 13.10.0 (or later) as soon as possible to mitigate the CRLF injection risk.

Other vulnerabilities in Laravel

CVE-2026-102279Low
In Laravel prior to versions 12.69.0 and 13.30.0, exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML=true, enabling DOM-based cross-site scripting when a user hovers over the tooltip.

Original NVD description (English source)

Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patched in versions 12.60.0 and 13.10.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS