{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fe0e872c-d74a-54f6-b3cc-5723c1639e7f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "type": "library", "group": "laravel", "bom-ref": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare", "version": "5.8.38-p8+tuxcare", "pedigree": { "ancestors": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@5.8.38", "type": "library", "group": "laravel", "version": "5.8.38" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "AIKIDO-2026-10659", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } ], "bom-ref": "urn:uuid:5568b0ba-f95e-5c51-8d46-acb85ef22280", "analysis": { "state": "resolved", "detail": "Vulnerability AIKIDO-2026-10659 is fixed in version 5.8.38-p8+tuxcare of laravel/framework." } }, { "id": "CVE-2017-14775", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } ], "bom-ref": "urn:uuid:00ea798d-4815-5d67-a145-ae2f96e9a10c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-14775 does not affect version 5.8.38-p8+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 where remember_me token verification used database WHERE clauses (non-constant-time comparison), enabling timing attacks. The target repository contains Laravel 5.8.38, which was released in 2019, well after the upstream fix was applied in Laravel 5.5.10 (September 2017). Both DatabaseUse...", "justification": "code_not_present" } }, { "id": "CVE-2018-15133", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } ], "bom-ref": "urn:uuid:35cbdfb6-267b-5a0a-a2ee-1083d62727db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15133 affects version 5.8.38-p8+tuxcare of laravel/framework." } }, { "id": "CVE-2019-9081", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } ], "bom-ref": "urn:uuid:3f4e5299-7463-5819-bd03-d15b86edacd8", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.8.38-p8+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." } }, { "id": "CVE-2020-19316", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } ], "bom-ref": "urn:uuid:3238847d-0d1c-5456-8fa2-dd0bdc02e057", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-19316 affects version 5.8.38-p8+tuxcare of laravel/framework." } }, { "id": "CVE-2020-24941", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } ], "bom-ref": "urn:uuid:4d981d6f-f2bf-56ad-a774-a10ceff7be22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-24941 is fixed in version 5.8.38-p8+tuxcare of laravel/framework." } }, { "id": "CVE-2021-21263", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } ], "bom-ref": "urn:uuid:936b39a0-92b5-5878-a955-d0daa70b5742", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-21263 affects version 5.8.38-p8+tuxcare of laravel/framework." } }, { "id": "CVE-2021-43617", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } ], "bom-ref": "urn:uuid:ac880e1c-a1dd-5930-b887-0749d03add99", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.8.38-p8+tuxcare." } }, { "id": "CVE-2021-43808", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } ], "bom-ref": "urn:uuid:eefb1088-a067-59e3-98ec-6c067dad41d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-43808 is fixed in version 5.8.38-p8+tuxcare of laravel/framework." } }, { "id": "CVE-2024-52301", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } ], "bom-ref": "urn:uuid:f0cea8e2-89ba-5f34-850d-f6d52928c55c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52301 is fixed in version 5.8.38-p8+tuxcare of laravel/framework." } }, { "id": "CVE-2025-27515", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } ], "bom-ref": "urn:uuid:302c4712-1917-5cbb-898a-c0c9b6b21b63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27515 is fixed in version 5.8.38-p8+tuxcare of laravel/framework." } }, { "id": "CVE-2026-102279", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } ], "bom-ref": "urn:uuid:d53beaaf-4453-53a4-830e-8f372ee43c2e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-102279 does not affect version 5.8.38-p8+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-114508", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } ], "bom-ref": "urn:uuid:fb8e4728-cf8f-583c-aa87-034a0acf6588", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114508 does not affect version 5.8.38-p8+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is not affected by CVE-2026-114508. The vulnerability exists in the JsonAPI resources feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, PR #57571) and does not exist in version 5.8.38. The target lacks all vulnerable components: the JsonApi directory, ResolvesJsonApiElements trait, sparseIncl...", "justification": "code_not_present" } }, { "id": "CVE-2026-114509", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } ], "bom-ref": "urn:uuid:c1812a78-c3c1-5482-91da-754cde2e1909", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114509 affects version 5.8.38-p8+tuxcare of laravel/framework." } }, { "id": "GHSA-4mg9-vhxq-vm7j", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } ], "bom-ref": "urn:uuid:71a2fe8d-c195-54fe-b51f-d44b20e03bb2", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.8.38-p8+tuxcare of laravel/framework." } }, { "id": "GHSA-5vg9-5847-vvmq", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } ], "bom-ref": "urn:uuid:a5fe22a7-713d-5cb6-9695-86532c07fab3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 5.8.38-p8+tuxcare of laravel/framework." } }, { "id": "GHSA-6jvx-8ch9-j2jr", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } ], "bom-ref": "urn:uuid:acc5889a-16fe-5411-adbb-0c476afd253c", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.8.38-p8+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT vulnerable to GHSA-6jvx-8ch9-j2jr (cookie serialization object injection). The vulnerability was fixed upstream in Laravel 5.6.30 (August 2018), and Laravel 5.8.38 (released later) shipped with the fix already applied. The target code has `protected static $serialize = false` in EncryptCookies.php, disabling serialization for all cookies and preventing PHP object injection...", "justification": "code_not_present" } }, { "id": "GHSA-7852-w36x-6mf6", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } ], "bom-ref": "urn:uuid:5152ab08-e33a-54e5-a27e-c99475ea9720", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.8.38-p8+tuxcare of laravel/framework. not_affected \u2014 The target repository laravel/framework 5.8.38-p8+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability was fixed in upstream Laravel before version 5.8.0 was released (patches from March 2018), and the fix was already present in the Laravel 5.8.38 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the IV length vali...", "justification": "code_not_present" } }, { "id": "GHSA-crmm-hgp2-wgrp", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } ], "bom-ref": "urn:uuid:b12de9f4-2757-5bd5-ba79-742cdf0e751d", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.8.38-p8+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue.", "justification": "code_not_present" } }, { "id": "GHSA-jwvj-pwww-3mj5", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } ], "bom-ref": "urn:uuid:8c8678ca-9abf-5481-ab06-13675becda0a", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.8.38-p8+tuxcare of laravel/framework." } }, { "id": "GHSA-qm5c-m76r-2hfr", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } ], "bom-ref": "urn:uuid:4a6a1ded-9b97-5163-9641-0260e44d4295", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.8.38-p8+tuxcare of laravel/framework." } }, { "id": "GHSA-wq8p-mqvg-2p5h", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } ], "bom-ref": "urn:uuid:d8652c08-4caa-59c9-8196-12fafa445e59", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.8.38-p8+tuxcare of laravel/framework." } }, { "id": "GHSA-x7p5-p2c9-phvg", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } ], "bom-ref": "urn:uuid:2d4ff46e-7d1c-5aa3-8eae-44d45762b55b", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.8.38-p8+tuxcare of laravel/framework." } } ], "dependencies": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p8+tuxcare" } ] }