CVE-2024-29291: laravel · n/a
Affects laravelSource CVE Database V5
Not known to be exploited · public exploit available (Exploit-DB) : upgrade to 12 as a priority.
Data as of 25 Oct 2026, 21:14 UTC
Rated High by the CNA (mitre) · No CVSS score from NVD or the CNA
- EPSS
- 1.3% chance of exploitation in 30 days – higher than 71% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 12
Exploitation evidence
t = 0 is the CVE’s publication on cve.org
Disclosed: evidence found.
CVE published 16 Apr 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: evidence found.
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
Timeline
CVE ID reserved
by mitre
, 28 days before disclosure
CVE published
on cve.org
, t = 0
First Exploit-DB entry (opens in a new tab)
Laravel Framework 11 - Credential Leakage
, 5 days after disclosure
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Upgrade laravel/laravel to 12.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Packagistlaravel/laravelpkg:composer/laravel/laravelOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade Laravel Framework to version 12 or later, where this issue is fixed. Additionally, ensure that debugging logs are disabled in production environments or that access controls on the storage/logs directory are properly configured to prevent unauthorized access to sensitive log files. Since a patch is available, applying the official fix is the recommended remediation.
Description
A vulnerability in Laravel Framework versions 8 through 11 may allow a remote attacker to discover database credentials stored in the storage/logs/laravel.log file. This issue arises if debugging logs are enabled and access controls are not properly configured. The vulnerability is disputed because proper access control can mitigate the risk. A fix is available in Laravel version 12.