LARAVEL/FRAMEWORK · GHSA-6rv8-qj5v-p8ch · Package
FIX → 13.41.0 · 12.72.0
Laravel's signed route helpers append numeric-keyed parameters to the query string without URL encoding, so an attacker can add a second expires field. The signature covers that field, but the request parser reads it as authoritative, so the link never expires.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only applications that pass attacker-influenced, numeric-keyed input (for example a request's query array) into signed URL generation where those values do not fill a route placeholder. Applications that pass only explicitly selected, string-keyed parameters are not exposed.
Not affected if static-parameters, string-keyed-params-only
Who cares composer, laravel, php, signed-urls
composer show laravel/frameworktemporarySignedRoute( or signedRoute( calls that receive request-derived arrays, such as $request->query()When an application passes attacker-influenced, numeric-keyed parameters (for example a request's query array) to temporarySignedRoute() or signedRoute(), and those parameters do not fill a route placeholder, Laravel appended their values to the query string without URL encoding. An attacker can use this to add a second expires field to the signed URL. The signature covers that field, but request parsing reads it as the authoritative value, so the signed URL is treated as never expiring. Exploitation requires the application to forward such input into signed URL generation.
This issue has been patched in Laravel 12.72.0 and 13.41.0, which URL-encode numeric-keyed query parameters: https://github.com/laravel/framework/pull/62401. Users should upgrade to one of these versions or later.
Do not pass request-derived arrays to signed route generation. Pass only explicitly selected, string-keyed parameters.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 13.41.0 · 12.72.0
laravel/framework below 12.72.0 on the 12.x line: move to 12.72.0laravel/framework from 13.0.0 below 13.41.0 on the 13.x line: move to 13.41.0