CVE-2025-27515

Name	CVE-2025-27515
Description	Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
php-laravel-framework (PTS)	bullseye	6.20.14+dfsg-2+deb11u1	vulnerable
	bullseye (security)	6.20.14+dfsg-2+deb11u2	vulnerable
	bookworm	8.83.26+dfsg-2	vulnerable
	sid, trixie	10.48.25+dfsg-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
php-laravel-framework	source	(unstable)	(unfixed)

Notes

https://github.com/laravel/framework/security/advisories/GHSA-78fx-h6xr-vch4
https://github.com/laravel/framework/commit/2d133034fefddfb047838f4caca3687a3ba811a5 (v12.1.1)