---
id: "GHSA-6rv8-qj5v-p8ch"
page: "https://infrastack.ai/live/GHSA-6rv8-qj5v-p8ch"
kind: "vulnerability"
aliases: ["GHSA-6rv8-qj5v-p8ch"]
title: "Temporary signed URL expiration bypass via unencoded numeric-keyed route parameters"
severity: "medium"
cvss: 4.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "laravel/framework", "fixed": ["12.72.0"], "affected": "< 12.72.0", "ecosystem": "composer"}, {"name": "laravel/framework", "fixed": ["13.41.0"], "affected": ">= 13.0.0, < 13.41.0", "ecosystem": "composer"}]
ecosystems: ["composer"]
tags: ["composer", "laravel", "package", "php", "signed-urls"]
not_affected_if: ["static-parameters", "string-keyed-params-only"]
published_at: "2026-11-11T13:51:58+00:00"
first_seen_at: "2026-11-11T14:01:45+00:00"
updated_at: "2026-11-11T14:02:13+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/laravel/framework/security/advisories/GHSA-6rv8-qj5v-p8ch", "first_seen_at": "2026-11-11T14:01:45+00:00"}]
exploit_sources: []
---

# Temporary signed URL expiration bypass via unencoded numeric-keyed route parameters

Link for people: https://infrastack.ai/live/GHSA-6rv8-qj5v-p8ch (this .md is for agents)

Laravel's signed route helpers append numeric-keyed parameters to the query string without URL encoding, so an attacker can add a second expires field. The signature covers that field, but the request parser reads it as authoritative, so the link never expires.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:laravel/framework affected < 12.72.0 fixed 12.72.0
- composer:laravel/framework affected >= 13.0.0, < 13.41.0 fixed 13.41.0

## How to check

- Check the installed version with `composer show laravel/framework`
- Search the code for `temporarySignedRoute(` or `signedRoute(` calls that receive request-derived arrays, such as `$request->query()`

## Fix

- `laravel/framework` below `12.72.0` on the 12.x line: move to `12.72.0`
- `laravel/framework` from `13.0.0` below `13.41.0` on the 13.x line: move to `13.41.0`

## Timeline

- 2026-11-11T14:01:45+00:00 ghsa-repo https://github.com/laravel/framework/security/advisories/GHSA-6rv8-qj5v-p8ch

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/laravel/framework/security/advisories/GHSA-6rv8-qj5v-p8ch

## From the sources

### Impact

When an application passes attacker-influenced, numeric-keyed parameters (for example a request's query array) to `temporarySignedRoute()` or `signedRoute()`, and those parameters do not fill a route placeholder, Laravel appended their values to the query string without URL encoding. An attacker can use this to add a second `expires` field to the signed URL. The signature covers that field, but request parsing reads it as the authoritative value, so the signed URL is treated as never expiring. Exploitation requires the application to forward such input into signed URL generation.

### Patches

This issue has been patched in Laravel 12.72.0 and 13.41.0, which URL-encode numeric-keyed query parameters: https://github.com/laravel/framework/pull/62401. Users should upgrade to one of these versions or later.

### Workarounds

Do not pass request-derived arrays to signed route generation. Pass only explicitly selected, string-keyed parameters.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_