CVE-2025-27515
Laravel Framework ≤ 11.44.1
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-27515 is a medium-severity Improper Neutralization of Wildcards or Matching Symbols (CWE-155) vulnerability in Laravel Framework. Its CVSS base score is 6.9 (Medium).
Operationally, ranked in the top 49% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-27515 is a high-severity vulnerability in Laravel, a popular PHP web application framework. It affects applications using wildcard validation rules for file or image fields, such as `files.*`. A user-crafted malicious request can bypass these validation rules, enabling unauthorized handling of invalid or malicious uploads. The issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-155. It was published on 2025-03-05 and resolved in Laravel versions 11.44.1 and 12.1.1.
Unauthenticated attackers with network access can exploit this vulnerability by submitting specially crafted requests to endpoints performing wildcard file validation. Successful exploitation allows bypassing intended security checks on uploaded files or images, potentially leading to severe impacts including high confidentiality, integrity, and availability compromises, such as executing arbitrary code, data exfiltration, or server disruption depending on the application's configuration.
The official Laravel security advisory (GHSA-78fx-h6xr-vch4) and the fixing commit (2d133034fefddfb047838f4caca3687a3ba811a5) recommend upgrading to Laravel 11.44.1 or 12.1.1 to mitigate the issue. No additional workarounds are specified in the provided references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6153
Vulnerability Data
Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly requires checking and sanitizing special elements such as wildcards before they are passed downstream.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input neutralization to block wildcard injection.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect wildcard issues but does not itself implement neutralization controls.
Secure development lifecycle mandates input validation and sanitization that directly prevents wildcard injection.
Application security requirements include rules for neutralizing special characters before downstream processing.
Secure architecture principles encourage safe handling of untrusted input but do not prescribe specific wildcard neutralization.
Secure coding standards explicitly require proper escaping or neutralization of wildcard and matching symbols.