{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:753dffbf-71c9-5fa6-bdf8-31845a5bf9a0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "type": "library", "group": "laravel", "bom-ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare", "version": "8.12.2-p5+tuxcare", "pedigree": { "ancestors": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@8.12.2", "type": "library", "group": "laravel", "version": "8.12.2" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-14775", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:02e1f904-4f48-5ade-8464-6adc644dc158", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-14775 does not affect version 8.12.2-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.2 (released December 2020) inherited the fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time compa...", "justification": "code_not_present" } }, { "id": "CVE-2018-15133", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:b2e09bc5-9859-5855-a0d5-c719921a8940", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15133 affects version 8.12.2-p5+tuxcare of laravel/framework." } }, { "id": "CVE-2019-9081", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:b85d5d1f-565d-5865-b145-c8723fe03361", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-9081 affects version 8.12.2-p5+tuxcare of laravel/framework." } }, { "id": "CVE-2020-19316", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:94ca3201-aa47-52d3-8fcb-1d0476c599a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-19316 affects version 8.12.2-p5+tuxcare of laravel/framework." } }, { "id": "CVE-2020-24941", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:0193d36e-63da-5d4b-a0d3-28574d6f72c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-24941 affects version 8.12.2-p5+tuxcare of laravel/framework." } }, { "id": "CVE-2021-21263", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:dd640a06-b694-52e3-bb5b-81d8cfe47790", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-21263 is fixed in version 8.12.2-p5+tuxcare of laravel/framework." } }, { "id": "CVE-2021-43617", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:8b4698b1-a7ba-5208-9abc-b67883c2b371", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.2-p5+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" } }, { "id": "CVE-2021-43808", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:587f2ccd-d125-5d7e-b4c0-15f9cbe8bed5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-43808 is fixed in version 8.12.2-p5+tuxcare of laravel/framework." } }, { "id": "CVE-2024-52301", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:0acee0da-d0fd-5db4-b2d0-0c80ed373551", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52301 is fixed in version 8.12.2-p5+tuxcare of laravel/framework." } }, { "id": "CVE-2025-27515", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:2c187725-e698-5a95-a1ad-cca1420f2523", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27515 is fixed in version 8.12.2-p5+tuxcare of laravel/framework." } }, { "id": "CVE-2026-102279", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:f354aea8-f757-5887-843f-28b0aa35d5ff", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-102279 does not affect version 8.12.2-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.2 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer which uses Tippy.js tooltips with allowHTML: true. Laravel 8.12.2 uses a completely different exception rendering system (Whoops/filp/whoops) that does not include Tippy.js or any JavaScript tooltip functionality. The vulnerable component was introduced in Laravel 11.x+, sever...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-114508", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:fcda89d5-6529-5e72-a66e-91c2224ed58b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114508 does not affect version 8.12.2-p5+tuxcare of laravel/framework. not_affected \u2014 Target version 8.12.2 predates the introduction of Laravel's JSON:API resource feature by approximately 5 years. The vulnerable code (ResolvesJsonApiElements trait with loadMissing() call) does not exist in this version. JSON:API resources were first introduced in Laravel v12.45.0 (December 2025) via commit 2f309363, while the target is from the 8.x series released around 2020. Exhaustive searc...", "justification": "code_not_present" } }, { "id": "CVE-2026-114509", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:bc7d9407-9eca-55cb-82ab-429494a5449f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114509 affects version 8.12.2-p5+tuxcare of laravel/framework." } }, { "id": "CVE-2026-33347", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:efec3fbd-7224-5044-814b-fd74f48df3f8", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-33347 is a false positive for laravel/framework 8.12.2-p5+tuxcare. false_positive \u2014 CVE-2026-33347 describes a vulnerability in a Markdown Embed extension with components (DomainFilteringAdapter, OscaroteroEmbedAdapter, EmbedRenderer) that process oEmbed content. This repository is laravel/framework (Laravel PHP web application framework), which does not contain any of these components, does not have embed/oEmbed functionality, and does not depend on the affected embed/embed l..." } }, { "id": "GHSA-4mg9-vhxq-vm7j", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:db866f9f-76e4-52e2-b84b-f980d7c9a3bc", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.2-p5+tuxcare of laravel/framework." } }, { "id": "GHSA-5vg9-5847-vvmq", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:6f1730c2-0b19-5664-9464-1450ddbb3d4b", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.2-p5+tuxcare of laravel/framework." } }, { "id": "GHSA-6jvx-8ch9-j2jr", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:f41566d8-104e-5517-bc3d-caba818666f0", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.2-p5+tuxcare of laravel/framework. not_affected \u2014 Target Laravel 8.12.2 is not affected by GHSA-6jvx-8ch9-j2jr (Laravel 5.6.30 cookie deserialization vulnerability). The fix disabling automatic cookie serialization was already present in the upstream Laravel 8.12.2 release, which predates TuxCare's onboarding of this repository. The vulnerable pattern (unsafe cookie deserialization enabling PHP object injection) is absent: EncryptCookies middl...", "justification": "code_not_present" } }, { "id": "GHSA-7852-w36x-6mf6", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:ed5d1831-96e3-5aa2-a33d-da13f5afd300", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.2-p5+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.12.2-p5+tuxcare is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (decryption returning false when IV length is manipulated) was already fixed in the upstream Laravel 8.12.2 release that TuxCare onboarded. The validPayload() method at src/Illuminate/Encryption/Encrypter.php:211-215 contains the required IV length validation that matches the vendor ...", "justification": "code_not_present" } }, { "id": "GHSA-crmm-hgp2-wgrp", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:a7f619a6-abcb-5708-b06f-add92df01873", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.2-p5+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.2 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability exists in Laravel 12.x's LocalFilesystemAdapter class which provides signed URL functionality for local filesystem storage. This feature does not exist in Laravel 8.12.2, which uses a different architecture where local filesystem adapters cannot generate temporary signed URLs.", "justification": "code_not_present" } }, { "id": "GHSA-jwvj-pwww-3mj5", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:49f204e2-8772-5d3f-9bb9-d04606285107", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.2-p5+tuxcare of laravel/framework." } }, { "id": "GHSA-qm5c-m76r-2hfr", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:40afe784-52b4-57b0-94b9-68712ef6c00e", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.2-p5+tuxcare of laravel/framework." } }, { "id": "GHSA-wq8p-mqvg-2p5h", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:c9a88269-61de-5f94-aedc-108514a49129", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.2-p5+tuxcare of laravel/framework." } }, { "id": "GHSA-x7p5-p2c9-phvg", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ], "bom-ref": "urn:uuid:72a80f5b-1a53-543e-8ed1-702024efdfc4", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.2-p5+tuxcare of laravel/framework." } } ], "dependencies": [ { "ref": "pkg:composer/laravel/framework@8.12.2-p5+tuxcare" } ] }