{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7bdf4999-bc22-52a7-b8c8-6adc3d551a04", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "type": "library", "group": "laravel", "bom-ref": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare", "version": "8.12.0-p6+tuxcare", "pedigree": { "ancestors": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@8.12.0", "type": "library", "group": "laravel", "version": "8.12.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-14775", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:04da90c3-db69-5638-b267-b1c916e65f14", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-14775 does not affect version 8.12.0-p6+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 8.12.0 is NOT AFFECTED by CVE-2017-14775. The vulnerability (timing attack on remember_me token verification via database string comparison) is not present. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison. The fix was shipped in upstream Laravel 5.5.10 (September 2017) and is present in Laravel 8.12.0, which TuxCare onboarde...", "justification": "code_not_present" } }, { "id": "CVE-2018-15133", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:f728ed34-fb8b-5c0f-a62f-866f42b827f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15133 affects version 8.12.0-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2019-9081", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:5797e4c8-054c-582f-ae6b-784ad2eb3d3d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-9081 affects version 8.12.0-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2020-19316", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:5e602b20-ef47-55c7-9452-5c18a1618ba5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-19316 affects version 8.12.0-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2020-24941", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:60274aff-acfb-59c9-9362-eef21d527c22", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-24941 affects version 8.12.0-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2021-21263", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:70d63abd-7520-52d7-8381-e19f8a605f8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-21263 is fixed in version 8.12.0-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2021-43617", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:0eb575cd-9355-58d4-9727-579e8d402c98", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.0-p6+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" } }, { "id": "CVE-2021-43808", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:2b8531be-3cb5-5212-9f52-8b818cd3551f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-43808 is fixed in version 8.12.0-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2024-52301", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:0a7c9132-15ce-5123-9931-25388bcbf072", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52301 is fixed in version 8.12.0-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2025-27515", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:f311876f-2fc5-5333-8924-bf24bad4744c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27515 is fixed in version 8.12.0-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2026-102279", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:f7286861-7799-5ebe-a56b-50e03cf01bba", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-102279 does not affect version 8.12.0-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-102279. The vulnerability exists in Laravel's modern exception renderer (introduced in Laravel 11.x+) that uses Tippy.js tooltips with allowHTML:true. Laravel 8.12.0 uses the Whoops library (filp/whoops) for exception rendering, which has a completely different architecture. The vulnerable components (formatted-source.blade.php, renderer/scripts.js, Ti...", "justification": "code_not_present" } }, { "id": "CVE-2026-114508", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:d6a9056e-fe21-5616-b5b3-0bbfe6322742", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114508 does not affect version 8.12.0-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resource feature, which processes `include` query parameters to load relationships. This feature was introduced in Laravel 12.x (commit 2f30936319, Dec 2025), approximately 5 years after version 8.12.0 (Dec 2020). The target version lacks the entire JSON:API resource system, including the vulnerabl...", "justification": "code_not_present" } }, { "id": "CVE-2026-114509", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:d3f6cd8b-edb7-5e21-93d6-e01dbff9957d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114509 affects version 8.12.0-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2026-33347", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:8b90d075-4de5-57da-8c31-31ee79ebaea6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-33347 does not affect version 8.12.0-p6+tuxcare of laravel/framework. CVE-2026-33347 in league/commonmark 1.6.7 is not affected. Refer to league/commonmark 1.6.7 for details.", "justification": "requires_dependency" } }, { "id": "GHSA-4mg9-vhxq-vm7j", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:2ba92a79-9561-5759-9158-3e12819a483a", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.0-p6+tuxcare of laravel/framework." } }, { "id": "GHSA-5vg9-5847-vvmq", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:a84a8b9c-a851-5e7d-bf4e-d9041ae1f754", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.0-p6+tuxcare of laravel/framework." } }, { "id": "GHSA-6jvx-8ch9-j2jr", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:905ff7ec-4a89-565b-a402-734e402bb77e", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.0-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object deserialization via cookies). The upstream Laravel 8.12.0 release already contained the fix with `protected static $serialize = false`, which disables cookie serialization globally. This defense was present in the snapshot commit 9014f5a213 that imported upstream Laravel 8.12.0 into the TuxCare repository, preventing the exploita...", "justification": "code_not_present" } }, { "id": "GHSA-7852-w36x-6mf6", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:8075eca6-6921-5d7d-9638-46b61a637fa0", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.0-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework v8.12.0 is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false instead of throwing exception when IV length is invalid) is not present because the IV length validation fix was already included in the upstream Laravel v8.12.0 release. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 includes the defensive che...", "justification": "code_not_present" } }, { "id": "GHSA-crmm-hgp2-wgrp", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:0915a40b-c148-5fd7-bc91-8551c14765cb", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.0-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.0-p3+tuxcare does not have the vulnerable LocalFilesystemAdapter class or local filesystem temporary URL generation feature. The vulnerability exists in Laravel 11+ where LocalFilesystemAdapter was introduced. The target version uses FilesystemAdapter which explicitly rejects temporary URL generation for local filesystem adapters with a RuntimeException.", "justification": "code_not_present" } }, { "id": "GHSA-jwvj-pwww-3mj5", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:c2eeb910-ee1e-5535-9ccd-7653fba1851a", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.0-p6+tuxcare of laravel/framework." } }, { "id": "GHSA-qm5c-m76r-2hfr", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:bafd7000-709c-5b2f-9ed6-7a20e2033aeb", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.0-p6+tuxcare of laravel/framework." } }, { "id": "GHSA-wq8p-mqvg-2p5h", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:5d80ca2d-2488-55c8-990d-252b6e87515b", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.0-p6+tuxcare of laravel/framework." } }, { "id": "GHSA-x7p5-p2c9-phvg", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } ], "bom-ref": "urn:uuid:f2433031-fe6c-50df-82b5-40149384c1d0", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.0-p6+tuxcare of laravel/framework." } } ], "dependencies": [ { "ref": "pkg:composer/laravel/framework@8.12.0-p6+tuxcare" } ] }