{"id":"CVE-2018-15133","kind":"vulnerability","aliases":["CVE-2018-15133"],"related":[],"title":"In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an…","description":"In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.","summary":"Laravel Framework deserializes untrusted data in its cookie/encryption handling, allowing remote command execution. An attacker who already holds the application encryption key (APP_KEY) can send crafted serialized payloads to run commands on the server.","severity":"high","cvss":8.1,"epss":null,"exploited":true,"exploited_at":"2024-01-16T00:00:00+00:00","products":[{"name":"Laravel Laravel Framework","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"laravel","fixed":[],"affected":"<= 5.5.40","ecosystem":"vendor"},{"name":"laravel","fixed":[],"affected":">= 5.6.0, <= 5.6.29","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","laravel","php","runtime","self-hosted"],"not_affected_if":["app-key-never-exposed"],"how_to_check":"Check whether APP_KEY in the .env file or environment has ever been exposed; grep the framework version with 'composer show laravel/framework'.","fix":"Upgrade laravel/framework to a release that includes the vendor fix, and rotate APP_KEY if it may have leaked.","status":"open","published_at":"2018-08-09T19:29:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:02:31+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-23T21:02:31Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade laravel/framework to a release that includes the vendor fix, and rotate APP_KEY if it may have leaked.\nunknown","reach":"internet","impact":"high","summary":"Laravel Framework deserializes untrusted data in its cookie/encryption handling, allowing remote command execution. An attacker who already holds the application encryption key (APP_KEY) can send crafted serialized payloads to run commands on the server.","category":"runtime","who_cares":["laravel","php","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs arbitrary commands on the server after obtaining APP_KEY.","analyst_note":"Sources do not list affected or fixed Laravel versions; check the vendor advisory and NVD entry for CVE-2018-15133 for exact version ranges and patch.","how_to_check":"Check whether APP_KEY in the .env file or environment has ever been exposed; grep the framework version with 'composer show laravel/framework'.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["app-key-never-exposed"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000496,"input_tokens":2842,"output_tokens":423,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-15133':21A,24A '-2018':20A,23A '5.5.40':5A,76C '5.6':7A,78C '5.6.29':10A,81C 'access':137C 'accomplish':140C 'allow':46B 'alreadi':53B 'app':59B 'applic':56B,121C 'attack':51B,117C,133C,143C 'call':93C 'code':12A,83C 'command':48B,68B 'cookie/encryption':44B 'could':129C 'craft':63B 'cve':19A,22A 'data':41B 'decrypt':106C 'deseri':39B 'encrypt':57B 'execut':13A,49B,84C 'exploit':30B 'framework':3A,27A,38B,74C 'gadgetchains/laravel/rce/3/chain.php':113C 'handl':45B 'happen':130C 'hold':54B 'host':36B 'illuminate/encryption/encrypter.php':109C 'involv':104C 'key':58B,60B,122C 'know':119C 'laravel':2A,25A,26A,28A,29A,31B,37B,73C 'method':107C 'might':14A,85C 'must':118C 'never':126C 'normal':124C 'occur':15A,86C,127C 'payload':65B 'pendingbroadcast':111C 'php':32B 'phpggc':115C 'potenti':96C 'previous':134C,142C 'privileg':136C 'remot':11A,47B,82C 'result':18A,89C 'run':67B 'runtim':33B 'self':35B 'self-host':34B 'send':62B 'serial':64B 'server':71B 'success':139C 'token':101C 'unseri':92C 'untrust':40B,97C 'valu':102C 'would':125C 'x':8A,79C,99C 'x-xsrf-token':98C 'xsrf':100C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2018-08-09T19:29:00+00:00","kev":{"dateAdded":"2024-01-16","dueDate":"2024-02-06","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2018-15133","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-15133","severity":null,"published_at":"2024-01-16T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2018-15133","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-15133","severity":null,"published_at":"2018-08-09T19:29:00+00:00","modified_at":"2026-06-17T01:42:06+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}