Executive brief
Maravel, a PHP web framework, allows attackers to discover internal route parameter names by intentionally sending requests with unprocessed template syntax. When a request matches the literal placeholder text (e.g., `/api/v1/users/{id}`), the framework throws an error instead of returning a standard 404, allowing an attacker to map out the application's internal route structure through pattern matching.
Technical details
The vulnerability is a side-channel information disclosure in route compilation. When dynamic route placeholders are registered, the raw template key is mistakenly added to the static route checklist. An attacker can send requests with literal brace syntax (e.g., `GET /api/v1/users/{id}`) to match against the static map, bypassing the dynamic tree engine. This causes PHP 8+ to throw an `ArgumentCountError` (resulting in HTTP 500) instead of the expected HTTP 404. By tracking which fuzz patterns generate 500 errors, attackers can programmatically enumerate and profile internal route parameter names and controller schemas. Version 10.73.1 and later contain a patch; a workaround involves implementing middleware to reject literal brace patterns before they reach the router.
Affected products
- Macropay Solutions Maravel prior to 10.73.1
Timeline
- 2026-09-08: disclosed