Laravel Framework path confusion in temporary signed URLs

Executive brief

A vulnerability in the Laravel web framework affects how temporary, time-limited links are processed. This could allow an attacker to use a link after it has expired or trick the system into accessing a different file than intended. In some cases, this could lead to unauthorized file uploads or data access.

Technical details

A path confusion vulnerability exists in Laravel's local filesystem driver due to improper encoding or escaping (CWE-116) when generating and parsing temporary signed URLs. Under specific conditions, the server may interpret the URL path differently at request time than it did during the signing process. This ambiguity allows an attacker to bypass expiration checks, keeping expired URLs valid indefinitely, or redirect requests to unintended resources. The vulnerability also affects the upload variant of signed URLs, potentially allowing unauthorized writes to unintended destinations. Patches are available in versions 12.61.1 and 13.12.0.

Affected products

• Laravel framework >= 13.0.0, < 13.12.0; < 12.61.1

Timeline

• 2026-06-08: disclosed: Vulnerability reported to Laravel framework
• 2026-06-17: advisory: GitHub Advisory published

References

• https://api.github.com/users/teebow1e
• https://github.com/teebow1e
• https://api.github.com/users/teebow1e/gists%7B/gist_id%7D
• https://api.github.com/users/teebow1e/repos
• https://avatars.githubusercontent.com/u/130235050?v=4
• https://api.github.com/users/teebow1e/events%7B/privacy%7D