{"id":"CVE-2021-3129","title":"Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of i","published":"2021-01-12T11:15:16.453Z","updated":"2026-06-17T00:04:43.133Z","severity":"critical","cvssScore":9.8,"epss":0.99943,"epssPct":0.99973,"kev":true,"maturity":"weaponized","actionScore":99,"primaryVendor":"laravel","primaryProduct":"laravel","cweId":null,"fixAvailable":true,"tags":["pre-auth","rce","remote","no-ui"],"epssDelta7":0,"summary":"Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssVersion":"3.1","cvssSource":"nvd-primary","cweName":null,"kevAdded":"2023-09-18T00:00:00.000Z","kevDue":"2023-10-09T00:00:00.000Z","kevRansomware":"Known","source":"nvd","cna":"mitre","ssvc":{"exploitation":"active","automatable":"yes","impact":"total"},"sources":{"tr":"2026-10-01T11:24:25.940Z","adp":"2025-10-21T23:35:30.227Z","cna":"2025-10-21T23:35:30.227Z","osv":"2026-11-13T03:18:18.039Z","epss":"2026-11-11","nuclei":"2026-11-13T03:18:10.620Z","cna_seen":"2026-09-29T10:58:17.254Z","exploitdb":"2026-11-13T03:17:58.683Z","github-poc":"2026-11-13T03:18:14.335Z","metasploit":"2026-11-13T03:18:09.107Z"},"cvssCna":null,"hasPatchRef":true,"credits":[],"counts":{"exploitdb":1,"metasploit":1,"nuclei":1,"githubPoc":33},"products":[{"vendor":"laravel","product":"laravel","cpe":"cpe:2.3:a:laravel:laravel"},{"vendor":"facade","product":"ignition","cpe":"cpe:2.3:a:facade:ignition"}],"references":[{"url":"https://github.com/facade/ignition/pull/334","tags":"Patch,Third Party Advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3129","tags":"US Government Resource"}],"exploits":[{"source":"exploitdb","kind":"webapps","date":"2021-01-14"},{"source":"metasploit","kind":"exploit","date":"2021-01-13"},{"source":"nuclei","kind":"critical","date":null},{"source":"github-poc","kind":"stars:288","date":"2021-01-13"},{"source":"github-poc","kind":"stars:134","date":"2021-01-22"},{"source":"github-poc","kind":"stars:78","date":"2021-01-25"},{"source":"github-poc","kind":"stars:18","date":"2021-01-27"},{"source":"github-poc","kind":"stars:69","date":"2021-01-27"},{"source":"github-poc","kind":"stars:2","date":"2021-02-14"},{"source":"github-poc","kind":"stars:167","date":"2021-02-18"},{"source":"github-poc","kind":"stars:0","date":"2021-04-11"},{"source":"github-poc","kind":"stars:1","date":"2021-07-22"},{"source":"github-poc","kind":"stars:12","date":"2021-10-01"},{"source":"github-poc","kind":"stars:7","date":"2022-04-08"},{"source":"github-poc","kind":"stars:158","date":"2022-04-16"},{"source":"github-poc","kind":"stars:5","date":"2022-06-04"},{"source":"github-poc","kind":"stars:0","date":"2022-09-30"},{"source":"github-poc","kind":"stars:6","date":"2022-10-11"},{"source":"github-poc","kind":"stars:7","date":"2022-12-10"},{"source":"github-poc","kind":"stars:13","date":"2023-03-04"},{"source":"github-poc","kind":"stars:1","date":"2023-03-11"},{"source":"github-poc","kind":"stars:0","date":"2023-05-01"},{"source":"github-poc","kind":"stars:0","date":"2023-07-26"},{"source":"github-poc","kind":"stars:2","date":"2023-07-27"},{"source":"github-poc","kind":"stars:0","date":"2023-10-22"},{"source":"github-poc","kind":"stars:6","date":"2024-01-15"},{"source":"github-poc","kind":"stars:0","date":"2024-05-19"},{"source":"github-poc","kind":"stars:0","date":"2024-07-16"},{"source":"github-poc","kind":"stars:10","date":"2024-09-29"},{"source":"github-poc","kind":"stars:0","date":"2024-10-31"},{"source":"github-poc","kind":"stars:0","date":"2024-12-04"},{"source":"github-poc","kind":"stars:1","date":"2025-01-30"},{"source":"github-poc","kind":"stars:0","date":"2026-06-06"},{"source":"github-poc","kind":"stars:1","date":"2026-07-18"},{"source":"github-poc","kind":"stars:0","date":"2026-08-07"},{"source":"github-poc","kind":"stars:0","date":"2026-10-08"}],"analysis":null,"affectedVersions":[{"vendor":"facade","product":"ignition","version":"*","vsi":null,"vse":null,"vei":null,"vee":"2.5.2"}],"source_attribution":"NVD (NIST), CVE Program, CISA KEV, FIRST EPSS, OSV. Aggregated by Noroxi."}