CVE-2026-48019

Name	CVE-2026-48019
Description	Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patched in versions 12.60.0 and 13.10.0.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1139631

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
php-laravel-framework (PTS)	bookworm	8.83.26+dfsg-2	vulnerable
	trixie	10.48.29+dfsg-1	vulnerable
	forky, sid	11.46.1+dfsg-4	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
php-laravel-framework	source	(unstable)	(unfixed)			1139631

[trixie] - php-laravel-framework <no-dsa> (Minor issue)
https://github.com/laravel/framework/security/advisories/GHSA-5vg9-5847-vvmq