{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:593af6eb-7637-5526-9749-059fcf1a7e90", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "type": "library", "group": "laravel", "bom-ref": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare", "version": "8.83.29-p6+tuxcare", "pedigree": { "ancestors": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@8.83.29", "type": "library", "group": "laravel", "version": "8.83.29" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "AIKIDO-2026-10659", "affects": [ { "ref": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } ], "bom-ref": "urn:uuid:8ee8e1ed-f652-5d64-8240-17a78120a093", "analysis": { "state": "resolved", "detail": "Vulnerability AIKIDO-2026-10659 is fixed in version 8.83.29-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2017-14775", "affects": [ { "ref": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } ], "bom-ref": "urn:uuid:178bde21-6f49-50e1-9553-15e183f6a5a8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-14775 does not affect version 8.83.29-p6+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 does not affect this target. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017). The target version 8.83.29, released years later, inherited this fix from upstream. Both DatabaseUserProvider and EloquentUserProvider use PHP's hash_equals() for constant-time token comparison at line 77. The TuxCare onbo...", "justification": "code_not_present" } }, { "id": "CVE-2018-15133", "affects": [ { "ref": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } ], "bom-ref": "urn:uuid:d6010920-49e2-56ed-999a-1a91d5e36f2a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15133 affects version 8.83.29-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2019-9081", "affects": [ { "ref": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } ], "bom-ref": "urn:uuid:8fff840b-a0e4-5b21-8219-1ff7ee32caa8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-9081 affects version 8.83.29-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2020-19316", "affects": [ { "ref": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } ], "bom-ref": "urn:uuid:0040285b-0a40-5a52-b780-6a5996ac8260", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-19316 affects version 8.83.29-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2020-24941", "affects": [ { "ref": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } ], "bom-ref": "urn:uuid:520f6f41-702c-55ea-b28c-8d3594cf2f87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-24941 affects version 8.83.29-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2021-21263", "affects": [ { "ref": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } ], "bom-ref": "urn:uuid:71a0dbfa-c7fc-5d22-b23a-845f9f81ebb5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-21263 affects version 8.83.29-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2021-43808", "affects": [ { "ref": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } ], "bom-ref": "urn:uuid:08395c30-723c-55f1-8455-bb6f146afe5c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-43808 does not affect version 8.83.29-p6+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 does not affect this target. The vulnerability (predictable parent placeholder hashes in Blade templates allowing XSS) was fixed by the upstream Laravel team before version 8.83.29 was released. The complete fix\u2014including random per-request salt generation, runtime placeholder creation, and cache invalidation\u2014is present in all three affected files. TuxCare onboarded an already-fi...", "justification": "code_not_present" } }, { "id": "CVE-2022-31279", "affects": [ { "ref": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } ], "bom-ref": "urn:uuid:f70204d7-fd8f-5286-9fab-81b9120cb961", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 8.83.29-p6+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" } }, { "id": "CVE-2024-36610", "affects": [ { "ref": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } ], "bom-ref": "urn:uuid:e24862d5-9dbb-5fc2-b913-7a28918be97e", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-36610 is a false positive for laravel/framework 8.83.29-p6+tuxcare." } }, { "id": "CVE-2024-52301", "affects": [ { "ref": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } ], "bom-ref": "urn:uuid:b698c754-d6a2-5b0d-b927-7531ac5efa46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52301 affects version 8.83.29-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2025-27515", "affects": [ { "ref": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } ], "bom-ref": "urn:uuid:98546301-91f3-5522-b581-6da919776ef4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27515 is fixed in version 8.83.29-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2026-102279", "affects": [ { "ref": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } ], "bom-ref": "urn:uuid:43ef8373-1477-5bad-873e-44586bf45456", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-102279 does not affect version 8.83.29-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-102279. The vulnerability exists in the new exception renderer with Tippy.js tooltips (allowHTML: true) introduced in Laravel 12.x. The target version uses Whoops library's PrettyPageHandler for debug exception rendering instead, which does not have Tippy.js or any tooltip system that could be exploited via attacker-controlled HTML content.", "justification": "code_not_present" } }, { "id": "CVE-2026-114508", "affects": [ { "ref": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } ], "bom-ref": "urn:uuid:445caee3-d40d-541e-96e6-d30bc1579547", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114508 does not affect version 8.83.29-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource relationship inclusion processing feature, which was introduced in Laravel 12.x (commit 2f30936319193371fc1ac338d171a5b92be9976de5). This feature is completely absent from Laravel 8.x. The vulnerable code path in ResolvesJsonApiElements.php does not exist in this version. The standard JsonResou...", "justification": "code_not_present" } }, { "id": "CVE-2026-114509", "affects": [ { "ref": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } ], "bom-ref": "urn:uuid:2189f435-f2d7-59c9-b02d-7f15e3ad6f3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-114509 is fixed in version 8.83.29-p6+tuxcare of laravel/framework." } }, { "id": "GHSA-4mg9-vhxq-vm7j", "affects": [ { "ref": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } ], "bom-ref": "urn:uuid:36f6cc91-49e5-59d2-a943-f25da112241d", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 8.83.29-p6+tuxcare of laravel/framework. not_affected \u2014 The SQL injection vulnerability (GHSA-4mg9-vhxq-vm7j) affecting Laravel's SQL Server driver when user input is passed to limit/offset/skip/take functions is NOT present in this target. The vulnerability was fixed in upstream Laravel 8.40.0, and the target version 8.83.29 already contains the fix. Integer casting defenses are present in both Builder.php (lines 2140, 2167) and SqlServerGrammar.ph...", "justification": "code_not_present" } }, { "id": "GHSA-5vg9-5847-vvmq", "affects": [ { "ref": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } ], "bom-ref": "urn:uuid:9caaf74d-83da-5ff5-88af-80f6774e8d26", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.83.29-p6+tuxcare of laravel/framework." } }, { "id": "GHSA-6jvx-8ch9-j2jr", "affects": [ { "ref": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } ], "bom-ref": "urn:uuid:5f0e0a77-a63d-53f6-b5be-2b744bddee2b", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.83.29-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The vulnerable pattern was fixed by upstream Laravel in version 5.6.30 (August 2018), and Laravel 8.83.29 (released September 2022) inherited this fix. The target uses `protected static $serialize = false` to disable PHP object serialization for all cookies, preventing CWE-502 deserialization attacks....", "justification": "code_not_present" } }, { "id": "GHSA-7852-w36x-6mf6", "affects": [ { "ref": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } ], "bom-ref": "urn:uuid:af54f072-d054-50bd-be96-7a7bc6647d22", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.83.29-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework 8.83.29-p6+tuxcare is NOT affected by GHSA-7852-w36x-6mf6. The vulnerability pattern (missing IV length validation in Encrypter::validPayload) is not present in the target. The fix was already included in the upstream Laravel 8.83.29 release when TuxCare onboarded it in August 2025. The IV length validation check (strlen(base64_decode($payload['iv'], true)) === open...", "justification": "code_not_present" } }, { "id": "GHSA-crmm-hgp2-wgrp", "affects": [ { "ref": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } ], "bom-ref": "urn:uuid:b418ba1c-86a6-5fbd-8a6c-c7de4918ff92", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.83.29-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.83.29 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerable component (LocalFilesystemAdapter with local filesystem signed URL serving) was introduced in Laravel 11.x/12.x and does not exist in this version.", "justification": "code_not_present" } }, { "id": "GHSA-jwvj-pwww-3mj5", "affects": [ { "ref": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } ], "bom-ref": "urn:uuid:b47e89dd-af54-525b-b68b-78907a1fc845", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 8.83.29-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.83.29 is NOT AFFECTED by GHSA-jwvj-pwww-3mj5. The vulnerability concerns unexpected query bindings when array values are passed to query builder methods expecting scalars. The upstream Laravel 8.83.29 release (November 2024) already contains the complete fix via the flattenValue() method and array flattening+slicing logic applied to all vulnerable methods ...", "justification": "code_not_present" } }, { "id": "GHSA-qm5c-m76r-2hfr", "affects": [ { "ref": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } ], "bom-ref": "urn:uuid:adf7e247-5f63-596f-8414-883175d62ee7", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.83.29-p6+tuxcare of laravel/framework." } }, { "id": "GHSA-wq8p-mqvg-2p5h", "affects": [ { "ref": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } ], "bom-ref": "urn:uuid:3ae67205-51ce-54c7-bba4-8d318b18a212", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 8.83.29-p6+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 8.83.29 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched upstream in Laravel versions 6.20.26, 7.30.5, and 8.40.0 (April/November 2021). Since version 8.83.29 > 8.40.0, the fix was already present in the upstream release that TuxCare onboarded. All four vulnerable entry points (limit/offset/skip/ta...", "justification": "code_not_present" } }, { "id": "GHSA-x7p5-p2c9-phvg", "affects": [ { "ref": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } ], "bom-ref": "urn:uuid:34c39895-a7a4-56cf-a1e9-11a912a1ab4b", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 8.83.29-p6+tuxcare of laravel/framework." } } ], "dependencies": [ { "ref": "pkg:composer/laravel/framework@8.83.29-p6+tuxcare" } ] }