CVE-2021-3129 · netVigilance record NV23-0133

Laravel Ignition File Upload

past due ransomware

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA deadline 2023-10-09 · passed 2 years 11 months ago · applies to US federal civilian agencies; used elsewhere as a reference SLA

What happened

Laravel Ignition contains a file upload vulnerability that allows unauthenticated remote attackers to execute malicious code due to insecure usage of file_get_contents() and file_put_contents().

Who is affected

Laravel Ignition. Affected version ranges are listed in the vendor advisory and the NVD entry linked under Sources.

Timeline

2023-09-18
Added to CISA KEVExploitation in the wild confirmed by CISA
2023-10-09
CISA remediation deadlinepassed 2 years 11 months ago

Sources

NVD entry for CVE-2021-3129 nvd.nist.gov/vuln/detail/CVE-2021-3129
CISA Known Exploited Vulnerabilities catalog www.cisa.gov/known-exploited-vulnerabilities-catalog
github.com github.com/facade/ignition/releases/tag/2.5.2
nvd.nist.gov nvd.nist.gov/vuln/detail/CVE-2021-3129