{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:368ace94-a18c-564e-b686-acbe2bda3fc0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "type": "library", "group": "laravel", "bom-ref": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare", "version": "10.48.29-p2+tuxcare", "pedigree": { "ancestors": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@10.48.29", "type": "library", "group": "laravel", "version": "10.48.29" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-14775", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } ], "bom-ref": "urn:uuid:848deac8-423f-5188-bde2-4320b1b668f1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-14775 does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 concerns timing attacks on remember_me token verification due to non-constant-time comparison in DatabaseUserProvider. The vulnerability was fixed in Laravel 5.5.10 (September 2017) by replacing database WHERE clause comparison with PHP's hash_equals(). Target version 10.48.29 was released years later and already includes this upstream fix. Both DatabaseUserProvider (line 76) and...", "justification": "code_not_present" } }, { "id": "CVE-2018-15133", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } ], "bom-ref": "urn:uuid:6b059d42-781e-5984-9803-0da8132054b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15133 affects version 10.48.29-p2+tuxcare of laravel/framework." } }, { "id": "CVE-2019-9081", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } ], "bom-ref": "urn:uuid:a1e81ca0-ef94-510b-ada3-0d3a264a0f78", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-9081 affects version 10.48.29-p2+tuxcare of laravel/framework." } }, { "id": "CVE-2020-19316", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } ], "bom-ref": "urn:uuid:8e5fbf92-4028-5e5a-8c6e-7e9cafcded6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-19316 affects version 10.48.29-p2+tuxcare of laravel/framework." } }, { "id": "CVE-2020-24941", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } ], "bom-ref": "urn:uuid:c4128333-98c5-56d1-829f-c1e4b83a0440", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-24941 affects version 10.48.29-p2+tuxcare of laravel/framework." } }, { "id": "CVE-2021-21263", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } ], "bom-ref": "urn:uuid:0071b4d6-f33a-5dff-8ff3-0921a84fdb23", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-21263 affects version 10.48.29-p2+tuxcare of laravel/framework." } }, { "id": "CVE-2021-43808", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } ], "bom-ref": "urn:uuid:05574bad-49b8-5029-a6b9-9290c90d1845", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-43808 does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 is not present in laravel/framework 10.48.29. The vulnerability involved predictable parent placeholder hashes in Blade templates that allowed XSS attacks. The fix (using per-request random salt in placeholder generation) was already present in upstream Laravel v10.48.29 when TuxCare onboarded this version. The target code contains the complete defense: ManagesLayouts.php has par...", "justification": "code_not_present" } }, { "id": "CVE-2024-52301", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } ], "bom-ref": "urn:uuid:71b9a9de-8ae0-54ba-a97f-87891dba05e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52301 affects version 10.48.29-p2+tuxcare of laravel/framework." } }, { "id": "CVE-2025-27515", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } ], "bom-ref": "urn:uuid:ecf7ce63-4051-501f-827a-31c30783ed68", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-27515 does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 The target repository (laravel/framework 10.48.29-p2+tuxcare) is NOT affected by CVE-2025-27515. The vulnerability\u2014a wildcard validation bypass where attackers could use special array keys ('0', '.', '*', '__asterisk__') to bypass validation rules\u2014was fixed in upstream Laravel commit a4f7a8f9b83e (2025-03-11) and shipped in the upstream v10.48.29 release (2025-03-12). TuxCare onboarded this alr...", "justification": "code_not_present" } }, { "id": "CVE-2026-102279", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } ], "bom-ref": "urn:uuid:4ad92413-495c-5eec-bced-7a6d899151ce", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-102279 does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.29 is not affected by CVE-2026-102279. This XSS vulnerability is specific to Laravel's custom exception renderer that uses Tippy.js tooltips with `allowHTML: true`, a feature introduced in Laravel 11+. The target version uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture without Tippy.js integration. Exhaustive search confi...", "justification": "code_not_present" } }, { "id": "CVE-2026-114508", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } ], "bom-ref": "urn:uuid:176d6e9f-9204-5eed-ac7b-ba59d5714987", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114508 does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.29 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resources feature, which processes relationship inclusion parameters (e.g., `?include=comments.truncate`) and was exploitable due to insufficient validation allowing arbitrary method execution. This feature was introduced in Laravel 12.x (PR #57571) and does not exist in Laravel 10.x. The target v...", "justification": "code_not_present" } }, { "id": "CVE-2026-114509", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } ], "bom-ref": "urn:uuid:aa124b3d-1ea2-5e84-8c55-4e7ca1838038", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-114509 is fixed in version 10.48.29-p2+tuxcare of laravel/framework." } }, { "id": "GHSA-4mg9-vhxq-vm7j", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } ], "bom-ref": "urn:uuid:895018fa-0eff-570f-ac43-e1825c5ce390", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel framework version 10.48.29 is not affected by GHSA-4mg9-vhxq-vm7j (SQL Server limit/offset SQL injection). The vulnerability was fixed in upstream Laravel 8.40.0 (released May 2021), and version 10.48.29 already contains the fix from upstream. All limit/offset input is validated with integer casts at both the query builder method level and SQL compilation level.", "justification": "code_not_present" } }, { "id": "GHSA-5vg9-5847-vvmq", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } ], "bom-ref": "urn:uuid:99e1b7bc-f63e-5f6a-861e-dc5c636c2029", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 10.48.29-p2+tuxcare of laravel/framework." } }, { "id": "GHSA-6jvx-8ch9-j2jr", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } ], "bom-ref": "urn:uuid:da8021c7-02ae-5607-a790-e924c6a27ab6", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.29-p2+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie deserialization). The vulnerability was fixed in upstream Laravel 5.6.30 (August 2018) by disabling cookie serialization. Laravel 10.x inherited this fix and never had the vulnerable pattern. The target code has `protected static $serialize = false` in EncryptCookies middleware (line 34), and all...", "justification": "code_not_present" } }, { "id": "GHSA-7852-w36x-6mf6", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } ], "bom-ref": "urn:uuid:d2b03560-347e-5f61-8159-bd38483e6f6f", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 The target is not affected. The vulnerability (decryption returning false instead of throwing an exception on manipulated IV lengths) is not present because the upstream fix was already included in Laravel v10.48.29 when TuxCare onboarded it. The fix validates that base64-decoded IV length matches the cipher's required length at line 250 of Encrypter.php, ensuring DecryptException is thrown for...", "justification": "code_not_present" } }, { "id": "GHSA-crmm-hgp2-wgrp", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } ], "bom-ref": "urn:uuid:e54aa9c8-3734-5830-898c-df97816860f7", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 10.x.", "justification": "code_not_present" } }, { "id": "GHSA-jwvj-pwww-3mj5", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } ], "bom-ref": "urn:uuid:beb36a5c-1787-59f7-b08f-8f77aacdd5d0", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework version 10.48.29 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerability involves crafted array values being passed to query builder methods where scalar values are expected, leading to unexpected query bindings. However, the target already contains comprehensive protections against this vulnerability through a `flattenValue()` method that normalizes array inputs ...", "justification": "code_not_present" } }, { "id": "GHSA-qm5c-m76r-2hfr", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } ], "bom-ref": "urn:uuid:211b5a3e-6776-5e73-94e3-c79b09e67423", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 10.48.29-p2+tuxcare of laravel/framework." } }, { "id": "GHSA-wq8p-mqvg-2p5h", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } ], "bom-ref": "urn:uuid:6efb416a-5699-5f00-b94a-afa89ad4daab", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 10.48.29-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 10.48.29 is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server LIMIT/OFFSET SQL injection). The vulnerability was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 in 2021. Laravel 10.48.29 (released in 2024) already contains these fixes from upstream. The defense is present at multiple layers: Builder.php casts limit/offset to integers when storing (lines 2602, 2...", "justification": "code_not_present" } }, { "id": "GHSA-x7p5-p2c9-phvg", "affects": [ { "ref": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } ], "bom-ref": "urn:uuid:898f8bd5-b245-5086-a9b2-06af1fc8f0f5", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 10.48.29-p2+tuxcare of laravel/framework." } } ], "dependencies": [ { "ref": "pkg:composer/laravel/framework@10.48.29-p2+tuxcare" } ] }