{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7b510133-1a61-5038-b903-1e0df5014515", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "type": "library", "group": "laravel", "bom-ref": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare", "version": "7.30.7-p6+tuxcare", "pedigree": { "ancestors": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@7.30.7", "type": "library", "group": "laravel", "version": "7.30.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "AIKIDO-2026-10659", "affects": [ { "ref": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } ], "bom-ref": "urn:uuid:20a78c6b-4cc2-5d56-a149-496cff70c41b", "analysis": { "state": "resolved", "detail": "Vulnerability AIKIDO-2026-10659 is fixed in version 7.30.7-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2017-14775", "affects": [ { "ref": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } ], "bom-ref": "urn:uuid:0e3ae193-9987-553d-bbc4-7a9d3be88a57", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-14775 does not affect version 7.30.7-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 7.30.7-p6+tuxcare is not affected by CVE-2017-14775. Both DatabaseUserProvider and EloquentUserProvider use constant-time hash_equals() comparison for remember_me tokens, preventing timing attacks. This fix was already present in the upstream Laravel 7.30.7 release (originally fixed in Laravel 5.5.10 by commit 576cba749f), which TuxCare imported via snapshot commit 5082773b92.", "justification": "code_not_present" } }, { "id": "CVE-2018-15133", "affects": [ { "ref": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } ], "bom-ref": "urn:uuid:ec909acb-49d8-5027-8252-99988b5df494", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15133 affects version 7.30.7-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2019-9081", "affects": [ { "ref": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } ], "bom-ref": "urn:uuid:bd7bd5ad-c78d-51e0-a1b3-b49a296e1b8f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-9081 affects version 7.30.7-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2020-19316", "affects": [ { "ref": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } ], "bom-ref": "urn:uuid:fcac0443-6e10-58e2-b4f8-2275620874ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-19316 affects version 7.30.7-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2020-24941", "affects": [ { "ref": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } ], "bom-ref": "urn:uuid:d6fce701-df17-539c-ba5a-9358f2f76b17", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-24941 affects version 7.30.7-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2021-21263", "affects": [ { "ref": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } ], "bom-ref": "urn:uuid:526a2354-7657-5d14-8a3d-4c7edac1ef98", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-21263 affects version 7.30.7-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2021-43617", "affects": [ { "ref": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } ], "bom-ref": "urn:uuid:4df090be-e331-5047-a1d7-da203a77e0e3", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 7.30.7-p6+tuxcare." } }, { "id": "CVE-2021-43808", "affects": [ { "ref": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } ], "bom-ref": "urn:uuid:ad4de375-20ac-5f52-96c7-bde95a9ba2dc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-43808 does not affect version 7.30.7-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2021-43808 (Blade XSS via predictable parent placeholder). The upstream fix was already present in v7.30.7 when TuxCare onboarded it. The fix implements random per-request salt for parent placeholders, making them unguessable and preventing XSS exploitation.", "justification": "code_not_present" } }, { "id": "CVE-2024-52301", "affects": [ { "ref": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } ], "bom-ref": "urn:uuid:f6f0b3e2-c3cc-5be6-9283-ed66346c1fe2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52301 affects version 7.30.7-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2025-27515", "affects": [ { "ref": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } ], "bom-ref": "urn:uuid:1aaeebee-1762-5583-87e3-6d863ba28a83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27515 is fixed in version 7.30.7-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2026-102279", "affects": [ { "ref": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } ], "bom-ref": "urn:uuid:f65b2a04-fae9-57bd-808f-f9e198e0b8e9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-102279 does not affect version 7.30.7-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is NOT affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's exception renderer system which uses Tippy.js tooltips with `allowHTML: true` on user-controlled data. Laravel 7.30.7 predates this feature entirely and uses the Whoops library for debug mode exception handling - a completely different architecture with no Tippy.js tooltips, no `data-tippy-content` att...", "justification": "code_not_present" } }, { "id": "CVE-2026-114508", "affects": [ { "ref": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } ], "bom-ref": "urn:uuid:defcccf6-e24b-5385-8026-f4872ec09cb7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114508 does not affect version 7.30.7-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JsonApi resource system, which was introduced in version 12.x, five major versions after the target. The vulnerable pattern requires: (1) JsonApi resources processing user-supplied `include` query parameters, (2) passing unsanitized nested relationship names to `loadMissing()`, and (3) potential invocation ...", "justification": "code_not_present" } }, { "id": "CVE-2026-114509", "affects": [ { "ref": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } ], "bom-ref": "urn:uuid:b9707302-94cc-5ee0-8e51-dca4a1eab843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114509 affects version 7.30.7-p6+tuxcare of laravel/framework." } }, { "id": "GHSA-4mg9-vhxq-vm7j", "affects": [ { "ref": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } ], "bom-ref": "urn:uuid:8946188e-4d90-5547-9ec1-4cec576cd788", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 7.30.7-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework v7.30.7-p6+tuxcare is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is absent because the upstream Laravel v7.30.5 release already included the fix, which adds integer casting to limit() and offset() methods in Builder.php. This version (7.30.7) inherits that upstream fix via the snapshot commit that imported the v7.30.7...", "justification": "code_not_present" } }, { "id": "GHSA-5vg9-5847-vvmq", "affects": [ { "ref": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } ], "bom-ref": "urn:uuid:ed1fb59d-b6be-5c37-b325-8df62980b527", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 7.30.7-p6+tuxcare of laravel/framework." } }, { "id": "GHSA-6jvx-8ch9-j2jr", "affects": [ { "ref": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } ], "bom-ref": "urn:uuid:8071d2d0-a6be-554a-b0b6-700eb0317718", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 7.30.7-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 7.30.7-p6+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization in cookies). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling PHP object serialization in cookies. Laravel 7.30.7 (released September 2020) already contains this fix. The target was onboarded from the upstream Laravel 7.30.7 release, which shipped wit...", "justification": "code_not_present" } }, { "id": "GHSA-7852-w36x-6mf6", "affects": [ { "ref": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } ], "bom-ref": "urn:uuid:fdf79404-1db7-584d-b417-ab12f86a8870", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 7.30.7-p6+tuxcare of laravel/framework. not_affected \u2014 Target Laravel v7.30.7 already contains the upstream IV length validation fix. The vulnerability (GHSA-7852-w36x-6mf6) allows decryption to return false instead of throwing an exception when processing payloads with manipulated IV length. The fix validates that decoded IV length matches expected cipher IV length (Encrypter.php:214). This was authored by Taylor Otwell on March 30, 2018, and ship...", "justification": "code_not_present" } }, { "id": "GHSA-crmm-hgp2-wgrp", "affects": [ { "ref": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } ], "bom-ref": "urn:uuid:991f1937-0f99-5940-a9ee-1a84646fea7b", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 7.30.7-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 7.30.7-p1+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in the LocalFilesystemAdapter class which provides temporary signed URL generation for local filesystems. This class and the associated local file serving feature were introduced in Laravel 9.x and do not exist in Laravel 7.x.", "justification": "code_not_present" } }, { "id": "GHSA-jwvj-pwww-3mj5", "affects": [ { "ref": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } ], "bom-ref": "urn:uuid:0a8be66d-a13c-594e-8723-0aeb95b42f43", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 7.30.7-p6+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 7.30.7 is NOT AFFECTED. All security fixes for GHSA-jwvj-pwww-3mj5 (preventing unexpected query bindings from array-valued parameters) were already present in the upstream Laravel 7.30.7 release before TuxCare created the snapshot. The target contains the `flattenValue()` method and uses it in all affected query builder methods (where, having, whereDate, whereTime, whereDay, wher...", "justification": "code_not_present" } }, { "id": "GHSA-qm5c-m76r-2hfr", "affects": [ { "ref": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } ], "bom-ref": "urn:uuid:2d7ca05f-56bf-504a-93e7-e7de9eb2fc44", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 7.30.7-p6+tuxcare of laravel/framework." } }, { "id": "GHSA-wq8p-mqvg-2p5h", "affects": [ { "ref": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } ], "bom-ref": "urn:uuid:f530217d-bbb4-56d9-8f94-972a27a4c3ce", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 7.30.7-p6+tuxcare of laravel/framework." } }, { "id": "GHSA-x7p5-p2c9-phvg", "affects": [ { "ref": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } ], "bom-ref": "urn:uuid:c6e4fc59-1d78-5a1d-92a2-2a3f8afd5f05", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 7.30.7-p6+tuxcare of laravel/framework." } } ], "dependencies": [ { "ref": "pkg:composer/laravel/framework@7.30.7-p6+tuxcare" } ] }