{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:90265d80-0ffc-5ac6-bc4c-b33b2179def1", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "type": "library", "group": "laravel", "bom-ref": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare", "version": "12.58.0-p6+tuxcare", "pedigree": { "ancestors": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@12.58.0", "type": "library", "group": "laravel", "version": "12.58.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "AIKIDO-2026-10659", "affects": [ { "ref": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:940e65d1-b3ac-53f2-a42f-521a4df5ee05", "analysis": { "state": "resolved", "detail": "Vulnerability AIKIDO-2026-10659 is fixed in version 12.58.0-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2017-14775", "affects": [ { "ref": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:20dc1d1d-a2ea-5e1f-a311-88d5f15bab4d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-14775 does not affect version 12.58.0-p6+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 concerns timing side-channel attacks in Laravel's remember_me token verification due to variable-time string comparison. The target repository (Laravel 12.58.0-p6+tuxcare) contains the fix: both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() for token comparison. The vulnerability pattern (SQL WHERE clause string comparison) is not present. The fix ...", "justification": "code_not_present" } }, { "id": "CVE-2018-15133", "affects": [ { "ref": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:54fdbca9-4644-5a21-a9e4-61131a8967f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15133 affects version 12.58.0-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2019-9081", "affects": [ { "ref": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:bdccc168-b8c1-536d-8aa0-e887e585a537", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-9081 affects version 12.58.0-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2020-19316", "affects": [ { "ref": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:182254e0-cd33-56dd-a320-3ed298db9087", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-19316 affects version 12.58.0-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2020-24941", "affects": [ { "ref": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:45b9cfdf-dce1-5e83-9d28-dfecfe606741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-24941 affects version 12.58.0-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2021-21263", "affects": [ { "ref": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:440ec5ad-f9a2-5e4e-849c-ee04b38af98a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-21263 affects version 12.58.0-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2021-43808", "affects": [ { "ref": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:89365bad-e480-5828-8207-28d680bdcdcd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-43808 does not affect version 12.58.0-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 12.58.0-p6+tuxcare is NOT AFFECTED by CVE-2021-43808. The vulnerability (predictable parent placeholder hash enabling XSS via placeholder injection) is not present because the fix was already included in the upstream Laravel 12.58.0 release that TuxCare onboarded. The target code contains the security mitigation: random per-request salt in parent placeholder generation (ManagesLayouts.p...", "justification": "code_not_present" } }, { "id": "CVE-2024-52301", "affects": [ { "ref": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:32f1d02f-f7d3-5c90-9440-45fff436edbb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52301 affects version 12.58.0-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2025-27515", "affects": [ { "ref": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:e01cb72f-2a5f-5f39-a6f3-bae0a4715fcd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-27515 does not affect version 12.58.0-p6+tuxcare of laravel/framework. not_affected \u2014 The target (Laravel framework v12.58.0-p6+tuxcare) is NOT AFFECTED by CVE-2025-27515. The vulnerability fix was already present in the upstream Laravel v12.58.0 release that TuxCare imported. The fix prevents wildcard validation bypass by preserving placeholder-encoded attribute names when validating File, Email, and Password rules, ensuring malicious array keys (like '.', '*', '__asterisk__') ...", "justification": "code_not_present" } }, { "id": "CVE-2026-102279", "affects": [ { "ref": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:e1148866-f74a-5176-a19c-965e64368fed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-102279 is fixed in version 12.58.0-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2026-114508", "affects": [ { "ref": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:b95e1a34-8d5b-5458-bf1f-d93044a0df1d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114508 affects version 12.58.0-p6+tuxcare of laravel/framework, and is fixed in 12.58.0-p7+tuxcare." } }, { "id": "CVE-2026-114509", "affects": [ { "ref": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:1ecc251a-5360-5c6f-9691-6c90737ac77c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-114509 is fixed in version 12.58.0-p6+tuxcare of laravel/framework." } }, { "id": "GHSA-4mg9-vhxq-vm7j", "affects": [ { "ref": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:3a7761ce-4b41-5dc4-be58-20b76d25fe46", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 12.58.0-p6+tuxcare of laravel/framework. not_affected \u2014 GHSA-4mg9-vhxq-vm7j describes SQL injection when user input is passed to Laravel's limit/offset functions on SQL Server connections. The vulnerability was patched in Laravel 8.40.0 (May 2021) by adding integer casting to these methods. The target version (Laravel 12.58.0-p6+tuxcare) already contains the upstream fix: Builder->limit() casts to (int) at line 3115, and Builder->offset() casts at l...", "justification": "code_not_present" } }, { "id": "GHSA-5vg9-5847-vvmq", "affects": [ { "ref": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:f0e8143d-24cc-52b3-ae47-9ce2758035a2", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 12.58.0-p6+tuxcare of laravel/framework." } }, { "id": "GHSA-6jvx-8ch9-j2jr", "affects": [ { "ref": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:a59edd4a-9749-5352-95bb-a257bb8b45db", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 12.58.0-p6+tuxcare of laravel/framework. not_affected \u2014 Target version 12.58.0 is NOT AFFECTED by GHSA-6jvx-8ch9-j2jr (PHP object injection via serialized cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018), and version 12.58.0 (2025) is 7 years newer. The fix disables PHP serialization for all cookies by setting static::$serialize = false, preventing unserialization of attacker-controlled cookie data and blocking the path to arbit...", "justification": "code_not_present" } }, { "id": "GHSA-7852-w36x-6mf6", "affects": [ { "ref": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:f9e95637-b76c-5770-b199-5b4eb8497191", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 12.58.0-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v12.58.0-p6+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decrypt to return false instead of throwing exception) has been fixed by upstream Laravel. The fix validates that base64-decoded IV length matches the expected cipher IV length (line 272: `strlen(base64_decode($payload['iv'], true)) === op...", "justification": "code_not_present" } }, { "id": "GHSA-crmm-hgp2-wgrp", "affects": [ { "ref": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:8d0d29b3-3192-51c5-bd90-6de7df963a7f", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-crmm-hgp2-wgrp is fixed in version 12.58.0-p6+tuxcare of laravel/framework." } }, { "id": "GHSA-jwvj-pwww-3mj5", "affects": [ { "ref": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:720014f7-58ad-5c5f-bde5-4c29910335a1", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 12.58.0-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 12.58.0 is not affected by GHSA-jwvj-pwww-3mj5 (unexpected query bindings from array values). The vulnerability was fixed in upstream Laravel 6.x in January 2021, and the fix was already present in Laravel 12.58.0 when TuxCare onboarded it. All query builder methods covered by the security patches (where, whereBetween, having, havingBetween, whereDate, where...", "justification": "code_not_present" } }, { "id": "GHSA-qm5c-m76r-2hfr", "affects": [ { "ref": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:b5b99560-8e87-54b9-a92d-73972424a41c", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 12.58.0-p6+tuxcare of laravel/framework." } }, { "id": "GHSA-wq8p-mqvg-2p5h", "affects": [ { "ref": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:8c4c6b6f-6ab4-5827-b0b4-a94880fcd511", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 12.58.0-p6+tuxcare of laravel/framework. not_affected \u2014 The target repository (laravel/framework 12.58.0-p6+tuxcare) is not affected by GHSA-wq8p-mqvg-2p5h. The SQL Server SQL injection vulnerability in limit/offset functions was patched in upstream Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Version 12.58.0 already contains all required integer casting and validation protections in both SqlServerGrammar.php and Builder.php. ...", "justification": "code_not_present" } }, { "id": "GHSA-x7p5-p2c9-phvg", "affects": [ { "ref": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:3f25a640-1045-50bd-9252-fe9ebd10d4af", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 12.58.0-p6+tuxcare of laravel/framework." } } ], "dependencies": [ { "ref": "pkg:composer/laravel/framework@12.58.0-p6+tuxcare" } ] }