Laravel Framework CRLF injection in default email rule

Executive brief

A vulnerability in the Laravel web framework could allow attackers to manipulate outbound emails sent by an application. By providing a specially crafted email address in forms like contact pages or login screens, an attacker can redirect messages to unintended recipients or alter the content of the emails. This could lead to unauthorized access or the use of the company's mail servers to send spam or malicious messages.

Technical details

A CRLF (Carriage Return Line Feed) injection vulnerability exists in Laravel's default email validation rule. When combined with specific handling behaviors in Symfony Mailer and Symfony Mime, an unauthenticated remote attacker can inject header or body content into outbound emails. This occurs when user-supplied email addresses are not adequately sanitized before reaching the mail transport layer. Attackers can exploit this to perform mail relay abuse, redirect sensitive communications, or modify message content. The vulnerability is patched in Laravel versions 12.60.0 and 13.10.0.

Affected products

• Laravel framework >= 13.0.0, <= 13.9.0, < 12.60.0

Timeline

• 2026-06-01: disclosed: Initial publication by maintainers
• 2026-06-17: advisory: GitHub Advisory published/reviewed

References

• https://api.github.com/users/OmarXtream
• https://github.com/OmarXtream
• https://api.github.com/users/OmarXtream/gists%7B/gist_id%7D
• https://api.github.com/users/OmarXtream/repos
• https://avatars.githubusercontent.com/u/48177756?v=4
• https://api.github.com/users/OmarXtream/events%7B/privacy%7D