---
id: "CVE-2018-15133"
kind: "vulnerability"
aliases: ["CVE-2018-15133"]
title: "In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an\u2026"
severity: "high"
cvss: 8.1
epss: null
exploited: true
status: "open"
category: "runtime"
products: [{"name": "Laravel Laravel Framework", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "laravel", "fixed": [], "affected": "<= 5.5.40", "ecosystem": "vendor"}, {"name": "laravel", "fixed": [], "affected": ">= 5.6.0, <= 5.6.29", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "laravel", "php", "runtime", "self-hosted"]
not_affected_if: ["app-key-never-exposed"]
published_at: "2018-08-09T19:29:00+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-15133", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15133", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an…

Laravel Framework deserializes untrusted data in its cookie/encryption handling, allowing remote command execution. An attacker who already holds the application encryption key (APP_KEY) can send crafted serialized payloads to run commands on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Laravel Laravel Framework affected ? fixed ?
- vendor:laravel affected <= 5.5.40 fixed ?
- vendor:laravel affected >= 5.6.0, <= 5.6.29 fixed ?

## How to check

Check whether APP_KEY in the .env file or environment has ever been exposed; grep the framework version with 'composer show laravel/framework'.

## Fix

Upgrade laravel/framework to a release that includes the vendor fix, and rotate APP_KEY if it may have leaked.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-15133
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2018-15133

## From the sources

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_