CVE-2026-48019: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') in laravel framework
Description
A CRLF injection vulnerability exists in Laravel framework versions prior to 12.60.0 and 13.10.0. This vulnerability affects email validation combined with Symfony Mailer and Mime handling, potentially allowing unauthenticated attackers to interfere with outbound email processing when sending mail to user-supplied addresses. The issue has been patched in versions 12.60.0 and 13.10.0.
CVSS v3.1
Score 8.9high
Affected software
laravel
framework
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-48019 describes a CRLF injection vulnerability (CWE-93) in the Laravel web application framework. The flaw arises from improper neutralization of CRLF sequences in Laravel's email validation logic, which when combined with how Symfony Mailer and Symfony Mime process certain character sequences, may allow an unauthenticated attacker to manipulate outbound email processing. This could impact applications that send emails to addresses provided by users. The vulnerability is fixed in Laravel versions 12.60.0 and 13.10.0.
Potential Impact
Successful exploitation could allow an unauthenticated attacker to interfere with outbound email processing, potentially leading to email injection attacks such as email header manipulation or unauthorized email sending. The CVSS v3.1 score is 8.9 (high severity), indicating high impact on confidentiality and integrity, with low impact on availability.
Mitigation Recommendations
Upgrade affected Laravel framework versions to 12.60.0 or later, or 13.10.0 or later, where this vulnerability has been patched. No other mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-20T17:44:09.587Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a9b44f4acd9273b4958ae4a
Added to database: 09/04/2026, 22:23:48 UTC
Last enriched: 09/15/2026, 01:11:15 UTC
Last updated: 10/19/2026, 18:48:21 UTC
Views: 117
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.