{"id":"CVE-2018-15133","title":"In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a pote","published":"2018-08-09T15:29:00.333Z","updated":"2026-06-16T21:42:06.387Z","severity":"high","cvssScore":8.1,"epss":0.7657,"epssPct":0.99549,"kev":true,"maturity":"weaponized","actionScore":85,"primaryVendor":"laravel","primaryProduct":"laravel","cweId":"CWE-502","fixAvailable":true,"tags":["pre-auth","rce","deser","remote","no-ui"],"epssDelta7":-0.0024,"summary":"In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssVersion":"3.1","cvssSource":"nvd-primary","cweName":"Deserialization of Untrusted Data","kevAdded":"2024-01-16T00:00:00.000Z","kevDue":"2024-02-06T00:00:00.000Z","kevRansomware":"Unknown","source":"nvd","cna":"mitre","ssvc":{"exploitation":"active","automatable":"no","impact":"total"},"sources":{"adp":"2025-10-21T23:45:49.105Z","cna":"2025-10-21T23:45:49.105Z","osv":"2026-11-13T03:18:18.039Z","epss":"2026-11-12","cna_seen":"2026-09-29T10:51:36.692Z","exploitdb":"2026-11-13T03:17:58.683Z","github-poc":"2026-11-13T03:18:14.335Z","metasploit":"2026-11-13T03:18:09.107Z"},"cvssCna":null,"hasPatchRef":false,"credits":[],"counts":{"exploitdb":1,"metasploit":1,"nuclei":0,"githubPoc":14},"products":[{"vendor":"laravel","product":"laravel","cpe":"cpe:2.3:a:laravel:laravel"}],"references":[{"url":"https://laravel.com/docs/5.6/upgrade#upgrade-5.6.30","tags":"Vendor Advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-15133","tags":"US Government Resource"}],"exploits":[{"source":"exploitdb","kind":"remote","date":"2019-07-16"},{"source":"metasploit","kind":"exploit","date":"2018-08-07"},{"source":"github-poc","kind":"stars:258","date":"2018-08-14"},{"source":"github-poc","kind":"stars:0","date":"2020-02-25"},{"source":"github-poc","kind":"stars:6","date":"2020-04-05"},{"source":"github-poc","kind":"stars:0","date":"2020-04-27"},{"source":"github-poc","kind":"stars:0","date":"2020-11-09"},{"source":"github-poc","kind":"stars:57","date":"2020-11-13"},{"source":"github-poc","kind":"stars:35","date":"2020-12-21"},{"source":"github-poc","kind":"stars:3","date":"2021-01-03"},{"source":"github-poc","kind":"stars:0","date":"2021-12-28"},{"source":"github-poc","kind":"stars:0","date":"2023-05-10"},{"source":"github-poc","kind":"stars:0","date":"2023-05-10"},{"source":"github-poc","kind":"stars:2","date":"2025-04-27"},{"source":"github-poc","kind":"stars:0","date":"2025-11-19"},{"source":"github-poc","kind":"stars:0","date":"2025-12-29"}],"analysis":null,"affectedVersions":[{"vendor":"laravel","product":"laravel","version":"*","vsi":null,"vse":null,"vei":"5.5.40","vee":null},{"vendor":"laravel","product":"laravel","version":"*","vsi":"5.6.0","vse":null,"vei":"5.6.29","vee":null}],"source_attribution":"NVD (NIST), CVE Program, CISA KEV, FIRST EPSS, OSV. Aggregated by Noroxi."}