CVE-2026-48019
CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay
- State
- Published
- Severity
- 8.9 High
- Published
- Sep 4, 2026
- Updated
- Sep 8, 2026
- Reserved
- May 20, 2026
Description
Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patched in versions 12.60.0 and 13.10.0.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.9 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L | GitHub_M |
Weaknesses
- CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')
Affected Products
| Product | Versions |
|---|---|
frameworklaravel |
|
References
- https://github.com/laravel/framework/security/advisories/GHSA-5vg9-5847-vvmq
- https://github.com/laravel/framework/pull/60151
- https://github.com/laravel/framework/commit/96e9a663db657cf37ef26cd794fda8ff60eaa451
- https://github.com/laravel/framework/commit/f336ba79e744257f84ebf0d096b0ebc62e8e1a4d
- https://github.com/laravel/framework/releases/tag/v12.60.0
- https://github.com/laravel/framework/releases/tag/v13.10.0
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.