MediumGHSA-crmm-hgp2-wgrp

Laravel Framework: Temporary Signed URL Path Confusion

Published 17 Jun 2026 · Updated 10 Sept 2026

Affected packages

laravel/frameworkComposer
Affected
>=13.0.0 <13.12.0
Fixed in
13.12.0
Update to the fixed version for your release line, for example:composer require laravel/framework:^13.12.0
laravel/frameworkComposer
Affected
<12.61.1
Fixed in
12.61.1
Update to the fixed version for your release line, for example:composer require laravel/framework:^12.61.1

Details

A vulnerability in Laravel's local filesystem driver allows temporary signed URLs to be parsed ambiguously, potentially misrouting requests and bypassing expiration enforcement.

Under certain conditions, a generated temporary signed URL can be interpreted differently by the server than intended at signing time. This may cause requests to resolve to an unintended resource, and can prevent expiration from being enforced, allowing expired URLs to remain valid indefinitely.

Impact

  • Expired temporary URLs may continue to be accepted
  • Requests may resolve to a different resource than the one that was signed
  • The upload variant may allow writes to reach an unintended destination

Is GHSA-crmm-hgp2-wgrp in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected laravel/framework, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.