Is CVE-2026-48019 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48019 being exploited in the wild.

How severe is CVE-2026-48019?

High severity, with a CVSS score of 8.9, published 4 September 2026.

Which products and versions are affected?

Laravel prior to 12.60.0 and 13.10.0; laravel/framework (Packagist) ECOSYSTEM:introduced=13.0.0,fixed=13.10.0.

Is there a fix for CVE-2026-48019?

Yes. laravel/framework (Packagist): upgrade to 13.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48019 attacked?

It is attacked over the network.

Am I affected by CVE-2026-48019?

Check whether you run Laravel or laravel/framework (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48019: Laravel CRLF injection in email validation

CVE-2026-48019 · Severity: high · CVSS 8.9 · Published 2026-09-04

Laravel is a popular web application framework used to build business applications. A flaw in how it validates email addresses allows an attacker to inject carriage return and line feed characters, potentially allowing them to manipulate outbound email messages sent to user-supplied addresses. This could result in emails being sent to unintended recipients or with altered content, impacting customer communication and trust.

Technologies: Laravel, laravel/framework (Packagist). Vendors: Laravel, Packagist.

Quick answers

Is CVE-2026-48019 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48019 being exploited in the wild.
How severe is CVE-2026-48019?: High severity, with a CVSS score of 8.9, published 4 September 2026.
Which products and versions are affected?: Laravel prior to 12.60.0 and 13.10.0; laravel/framework (Packagist) ECOSYSTEM:introduced=13.0.0,fixed=13.10.0.
Is there a fix for CVE-2026-48019?: Yes. laravel/framework (Packagist): upgrade to 13.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48019 attacked?: It is attacked over the network.
Am I affected by CVE-2026-48019?: Check whether you run Laravel or laravel/framework (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

laravel/framework (Packagist): upgrade to 13.10.0 or later
```
composer require laravel/framework:^13.10.0
```

Technical details

A CRLF injection vulnerability exists in Laravel's email validation logic, specifically in how it processes the Address class. The vulnerability arises from insufficient validation of carriage return (\r) and line feed (\n) characters in email address strings. When combined with how Symfony Mailer and Symfony Mime libraries handle certain character sequences, an unauthenticated attacker can craft a malicious email address that breaks out of the intended email headers and injects arbitrary email headers or content. The attack requires that the application accepts and sends mail to user-supplied email addresses. The fix, implemented in versions 12.60.0 and 13.10.0, adds regex validation to reject email addresses containing line break characters using preg_match('/[\r\n]/', $address).

Affected products

Laravel Laravel prior to 12.60.0 and 13.10.0

Identifiers

CVE-2026-48019
GHSA-5vg9-5847-vvmq

Timeline

2026-09-04: disclosed
2026-05-17: patched: Patch committed to framework; versions 12.60.0 and 13.10.0 contain the fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.