CVE-2024-52301
Laravel Framework ≤ 6.20.45
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2024-52301 is a high-severity Argument Injection (CWE-88) vulnerability in Laravel Framework. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked in the top 1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Laravel is a PHP-based web application framework affected by CVE-2024-52301. The flaw occurs when the PHP directive register_argc_argv is enabled, allowing a specially crafted query string supplied to any URL to alter the application environment that the framework selects during request handling. The issue stems from improper handling of argv values for environment detection on non-CLI SAPIs and is tracked under CWE-88. It was resolved in Laravel releases 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0 by ensuring argv values are ignored for environment detection outside CLI contexts.
An unauthenticated remote attacker can exploit the vulnerability over the network by sending a crafted HTTP request containing a malicious query string. Successful exploitation permits the attacker to force the application into an unintended environment, which can result in high-integrity impacts such as altered configuration or behavior without requiring user interaction or elevated privileges.
The GitHub Security Advisory GHSA-gv7v-rgg6-548h and the Debian LTS announcement both direct users to upgrade to one of the patched Laravel versions listed above. They note that the framework update prevents argv-based environment overrides on non-CLI SAPIs, eliminating the vector when register_argc_argv remains enabled.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-3258
Vulnerability Data
Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling…
more
the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0. The framework now ignores argv values for environment detection on non-cli SAPIs.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.2.5
Mitigating Controls (NIST 800-53 r5) AI
Developer testing can discover argument-injection flaws in command-construction code but does not stop their introduction.
Input validation directly stops construction of command strings containing unneutralized delimiters or injected arguments.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper input validation and command construction to prevent argument injection.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect argument injection but does not prevent it at the source.
Secure development lifecycle mandates input validation and command construction practices that directly prevent argument injection.
Application security requirements include explicit rules for safe command-line argument handling and escaping.
Secure architecture principles discourage unsafe command invocation patterns and favor safer APIs.
Secure coding standards explicitly require proper neutralization of command arguments, directly eliminating CWE-88.
Change management can catch unsafe command patterns during reviews but is not a direct mitigation.