CVE-2026-48019

Received Received - Intake

CRLF Injection in Laravel Email Validation

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: GitHub, Inc.

Description

Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patched in versions 12.60.0 and 13.10.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-04

Last Modified

2026-09-04

Generated

2026-09-05

AI Q&A

2026-09-05

EPSS Evaluated

N/A

NVD

CVE-2026-48019

Affected Vendors & Products

Vendor	Product	Version / Range
laravel	laravel	to 12.60.0 (exc)
laravel	laravel	to 13.10.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

Executive Summary

Laravel versions before 12.60.0 and 13.10.0 have a CRLF injection vulnerability in email validation. When combined with Symfony Mailer and Mime handling, an attacker can manipulate outbound emails sent to user-provided addresses without authentication.

Detection Guidance

To detect this vulnerability, check your Laravel application's version. If it is below 12.60.0 or 13.10.0, it is vulnerable. Run: composer show laravel/framework to verify the installed version.

Impact Analysis

An unauthenticated attacker could alter email content, headers, or delivery paths. This may lead to phishing attacks, misinformation, or unauthorized email redirection in applications relying on user-supplied email addresses.

Compliance Impact

This vulnerability could violate GDPR by exposing user data through manipulated emails or HIPAA by sending unauthorized health information. Compliance may be impacted if email integrity is compromised.

Mitigation Strategies

Upgrade Laravel to version 12.60.0 or 13.10.0 or later to patch the CRLF injection vulnerability in email validation.

Hi! I’m here to help you understand CVE-2026-48019. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70