{"id":"CVE-2024-52301","summary":"Laravel allows environment manipulation via query string","details":"Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0. The framework now ignores argv values for environment detection on non-cli SAPIs.","aliases":["BIT-laravel-2024-52301","GHSA-gv7v-rgg6-548h"],"modified":"2026-08-12T03:51:28.075809276Z","published":"2024-11-12T19:32:14.415Z","database_specific":{"cwe_ids":["CWE-88"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52301.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00019.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52301.json"},{"type":"ADVISORY","url":"https://github.com/laravel/framework/security/advisories/GHSA-gv7v-rgg6-548h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52301"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/laravel/framework","events":[{"introduced":"0"},{"fixed":"841d842bbdc8e08c6364a8c06212c7286bbf0b9a"},{"introduced":"0b12ef19623c40e22eff91a4b48cb13b3b415b25"},{"fixed":"0fe75bafb8703c6c8184792b91ce5e27ad80aa7b"},{"introduced":"43bea00fd27c76c01fd009e46725a54885f4d2a5"},{"fixed":"83e64679d0688ee83b9224b60831dcf4b1a812f7"},{"introduced":"fbe7ed828819eadabb3cb9f95847a2ffe8846fd6"},{"fixed":"a069cf17e4943fb88d2a91c92690004fb3236dab"},{"introduced":"be2ddb5c31b0b9ebc2738d9f37a9d4c960aa3199"},{"fixed":"625269ca4881d2b50eded2045cb930960a181d98"},{"introduced":"6089f679d6d29e6071a6448ed5e96de02e57fedb"},{"fixed":"365090ed2c68244e3141cdb5e247cdf3dfba2c40"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:laravel:framework:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"6.20.45"},{"introduced":"7.0.0"},{"fixed":"7.30.7"},{"introduced":"8.0.0"},{"fixed":"8.83.28"},{"introduced":"9.0.0"},{"fixed":"9.52.17"},{"introduced":"10.0.0"},{"fixed":"10.48.23"},{"introduced":"11.0.0"},{"fixed":"11.31.0"}]}}],"versions":["v11.30.0","v11.29.0","v11.28.1","v11.28.0","v11.27.2","v11.27.1","v11.27.0","v11.26.0","v11.25.0","v11.24.1","v11.24.0","v10.48.22","v11.23.4","v10.48.21","v11.23.3","v11.23.2","v11.23.1","v11.23.0","v11.22.0","v11.21.0","v10.48.20","v11.20.0","v10.48.19","v11.19.0","v11.18.1","v11.18.0","v11.17.0","v11.16.0","v11.15.0","v11.14.0","v11.13.0","v11.12.0","v11.11.1","v11.11.0","v11.10.0","v11.9.2","v11.9.1","v11.9.0","v11.8.0","v11.7.0","v11.6.0","v10.48.10","v10.48.9","v11.5.0","v10.48.8","v11.4.0","v11.3.1","v10.48.7","v10.48.6","v11.3.0","v10.48.5","v11.2.0","v11.1.1","v11.1.0","v11.0.8","v10.48.4","v11.0.7","v10.48.3","v11.0.6","v11.0.5","v11.0.4","v11.0.3","v11.0.2","v11.0.1","v11.0.0","v10.48.2","v10.48.1","v10.48.0","v10.47.0","v10.46.0","v10.45.1","v10.45.0","v10.44.0","v10.43.0","v10.42.0","v10.41.0","v10.40.0","v10.39.0","v9.52.16","v10.38.2","v10.38.1","v10.38.0","v10.37.3","v10.37.2","v10.37.1","v10.37.0","v10.36.0","v10.35.0","v10.34.2","v10.34.1","v10.34.0","v10.33.0","v10.32.1","v10.32.0","v10.31.0","v10.30.1","v10.30.0","v10.29.0","v10.28.0","v10.27.0","v10.26.2","v10.26.1","v9.52.15","v10.26.0","v10.25.2","v10.25.1","v10.25.0","v10.24.0","v10.23.1","v10.23.0","v10.22.0","v10.21.1","v10.21.0","v10.20.0","v10.19.0","v10.18.0","v9.52.14","v10.17.1","v9.52.13","v10.17.0","v9.52.12","v10.16.1","v10.16.0","v9.52.11","v10.15.0","v9.52.10","v10.14.1","v10.14.0","v10.13.5","v9.52.9","v10.13.3","v10.13.2","v10.13.1","v9.52.8","v10.13.0","v10.12.0","v10.11.0","v10.10.1","v10.10.0","v10.9.0","v9.52.7","v9.52.6","v10.8.0","v10.7.1","v10.7.0","v10.6.2","v10.6.1","v10.6.0","v10.5.1","v9.52.5","v10.5.0","v10.4.1","v10.4.0","v10.3.3","v10.3.2","v10.3.1","v10.3.0","v10.2.0","v9.52.4","v9.52.3","v9.52.2","v9.52.1","v9.52.0","v10.0.0","v9.51.0","v9.50.2","v9.50.1","v9.50.0","v9.49.0","v9.47.0","v9.46.0","v9.45.1","v9.45.0","v8.83.27","v9.44.0","v9.43.0","v9.42.2","v9.42.1","v9.42.0","v9.41.0","v9.40.1","v9.40.0","v9.39.0","v8.83.26","v9.38.0","v9.37.0","v9.36.4","v9.36.3","v9.36.2","v9.36.1","v9.36.0","v9.35.1","v9.35.0","v9.34.0","v9.33.0","v8.83.24","v9.32.0","v9.31.0","v9.30.1","v9.30.0","v9.29.0","v9.28.0","v9.27.0","v9.26.1","v9.26.0","v9.25.1","v9.25.0","v9.24.0","v9.23.0","v9.22.1","v9.22.0","v9.21.6","v9.21.5","v9.21.4","v9.21.3","v9.21.2","v9.21.1","v8.83.20","v9.21.0","v8.83.19","v9.20.0","v9.19.0","v8.83.18","v9.18.0","v8.83.17","v8.83.16","v9.17.0","v9.16.0","v9.15.0","v9.14.1","v8.83.14","v9.14.0","v8.83.13","v9.13.0","v9.12.2","v9.12.1","v8.83.12","v9.12.0","v8.83.11","v9.11.0","v9.10.1","v8.83.10","v9.10.0","v9.9.0","v8.83.9","v8.83.8","v9.8.1","v9.8.0","v8.83.7","v9.7.0","v9.6.0","v8.83.5","v9.5.1","v9.5.0","v9.4.1","v8.83.4","v9.4.0","v8.83.3","v9.3.1","v9.3.0","v9.2.0","v8.83.2","v8.83.1","v9.1.0","v8.83.0","v9.0.2","v9.0.1","v9.0.0","v8.82.0","v8.81.0","v6.20.44","v8.78.0","v8.77.1","v8.77.0","v8.76.2","v6.20.43","v7.30.6","v6.20.42","v8.75.0","v8.74.0","v8.73.2","v6.20.41","v8.73.1","v8.73.0","v7.30.5","v6.20.40","v8.72.0","v6.20.39","v8.71.0","v8.70.2","v6.20.38","v8.70.1","v8.70.0","v6.20.37","v8.68.0","v6.20.36","v8.67.0","v8.66.0","v8.65.0","v8.64.0","v8.63.0","v8.62.0","v8.61.0","v8.60.0","v8.59.0","v6.20.34","v6.20.33","v8.58.0","v8.57.0","v8.56.0","v6.20.32","v8.55.0","v8.54.0","v6.20.31","v8.53.1","v8.53.0","v8.52.0","v8.51.0","v8.50.0","v6.20.30","v8.49.2","v8.49.1","v8.49.0","v8.48.2","v8.48.1","v8.48.0","v6.20.28","v8.47.0","v8.46.0","v8.45.1","v8.45.0","v8.44.0","v8.43.0","v8.42.1","v8.42.0","v8.41.0","v8.40.0","v6.20.25","v6.20.24","v8.38.0","v6.20.23","v8.36.0","v6.20.22","v8.35.1","v8.35.0","v6.20.21","v6.20.20","v6.20.19","v8.33.0","v6.20.18","v8.32.1","v8.32.0","v8.31.0","v6.20.17","v8.30.0","v8.30.1","v8.29.0","v8.28.1","v8.28.0","v8.27.0","v6.20.16","v8.26.1","v8.26.0","v7.30.4","v8.25.0","v6.20.15","v6.20.14","v8.24.0","v8.23.1","v6.20.13","v8.23.0","v6.20.12","v6.20.11","v8.22.1","v8.22.0","v6.20.10","v6.20.9","v8.21.0","v8.20.1","v7.30.1","v6.20.8","v8.20.0","v8.19.0","v6.20.7","v8.17.2","v8.17.1","v7.30.0","v6.20.6","v8.17.0","v8.16.0","v6.20.5","v6.20.4","v8.15.0","v8.14.0","v6.20.3","v7.29.3","v6.20.2","v8.13.0","v7.29.2","v8.12.3","v8.12.2","v8.12.1","v7.29.1","v6.20.1","v8.12.0","v6.20.0","v7.29.0","v8.11.2","v6.19.1","v8.11.0","v8.11.1","v6.19.0","v6.18.43","v7.28.4","v6.18.42","v8.9.0","v8.8.0","v8.7.1","v6.18.41","v8.7.0","v8.6.0","v7.28.3","v8.5.0","v8.4.0","v8.3.0","v7.28.2","v6.18.40","v8.2.0","v8.1.0","v8.0.4","v8.0.3","v7.28.1","v8.0.2","v8.0.1","v7.28.0","v6.18.39","v8.0.0","v7.27.0","v6.18.38","v6.18.37","v7.26.1","v7.26.0","v6.18.36","v6.18.35","v7.25.0","v7.24.0","v6.18.34","v7.23.2","v7.23.1","v6.18.33","v7.23.0","v6.18.32","v7.22.4","v6.18.31","v7.22.3","v6.18.30","v7.22.2","v6.18.29","v7.22.1","v6.18.28","v7.22.0","v6.18.27","v7.21.0","v6.18.26","v7.20.0","v6.18.25","v7.19.1","v7.19.0","v6.18.24","v6.18.23","v7.18.0","v6.18.22","v7.17.2","v6.18.21","v7.17.1","v7.17.0","v7.16.1","v6.18.20","v7.16.0","v6.18.19","v7.15.0","v6.18.18","v7.14.1","v6.18.17","v7.13.0","v6.18.16","v7.12.0","v6.18.15","v7.11.0","v7.10.3","v7.10.2","v6.18.13","v7.10.1","v7.10.0","v6.18.12","v6.18.11","v7.9.2","v7.9.1","v7.9.0","v7.8.1","v7.8.0","v6.18.10","v7.7.1","v6.18.9","v7.7.0","v7.6.2","v6.18.8","v6.18.7","v7.6.1","v7.6.0","v7.5.2","v6.18.6","v7.5.1","v6.18.5","v6.18.4","v7.5.0","v7.4.0","v6.18.3","v7.3.0","v7.2.2","v7.2.1","v6.18.2","v7.2.0","v7.1.3","v7.1.2","v7.1.1","v6.18.1","v7.1.0","v7.0.8","v7.0.7","v7.0.6","v7.0.5","v7.0.4","v7.0.3","v6.18.0","v7.0.2","v7.0.1","v7.0.0","v6.17.1","v6.17.0","v6.16.0","v6.15.1","v6.15.0","v6.14.0","v6.13.1","v6.13.0","v6.12.0","v6.11.0","v6.10.1","v6.10.0","v6.9.0","v6.8.0","v6.7.0","v6.6.2","v6.6.1","v6.6.0","v6.5.2","v6.5.1","v6.5.0","v6.4.1","v6.4.0","v6.3.0","v6.2.0","v6.1.0","v6.0.4","v6.0.3","v6.0.2","v6.0.1","v6.0.0","v5.5.1","v5.5.0","v4.1.0","v4.0.0","v4.0.0-BETA4","v4.0.0-BETA3","v4.0.0-BETA2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-52301.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}]}