CVE-2024-52301

Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0. The framework now ignores argv values for environment detection on non-cli SAPIs.

Scoring

Severity

HIGH

CVSS base score

8.7

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

EPSS probability

44.77%

CWE

CWE-88

Published

2024-11-12

Last modified

2026-03-13

Affected products

• laravel framework
• laravel framework
• laravel framework
• laravel framework
• laravel framework
• laravel framework

Weakness type

• CWE-88

Related vulnerabilities

• CVE-2026-8044 — CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')...
• CVE-2026-87818 — GitPython 3.1.59 Local File Content Oracle via --no-index
• CVE-2026-87794 — bestzip 2.2.6 and 3.0.2 Argument Injection via the Native Zip Destination
• CVE-2026-78635 — Improper Input Validation in the Okta Privileged Access SSH Client URL Handler Argument
• CVE-2026-71377 — Command Argument Injection Vulnerability in Cosminexus Component Container
• CVE-2026-84256 — An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.6 on...
• CVE-2026-86060 — SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
• CVE-2026-85626 — git-mcp-server 2.15.1 Argument Injection via Git Ref Parameters

Markdown version · Browse all CVEs