{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:524d716e-f957-5b19-afd7-c589737fd5d0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "type": "library", "group": "laravel", "bom-ref": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare", "version": "9.52.21-p4+tuxcare", "pedigree": { "ancestors": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@9.52.21", "type": "library", "group": "laravel", "version": "9.52.21" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "AIKIDO-2026-10659", "affects": [ { "ref": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } ], "bom-ref": "urn:uuid:ec5151a1-ea4e-50f9-b80b-0f3bcd53f54b", "analysis": { "state": "resolved", "detail": "Vulnerability AIKIDO-2026-10659 is fixed in version 9.52.21-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2017-14775", "affects": [ { "ref": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } ], "bom-ref": "urn:uuid:2b6044e8-6b84-5c04-9e8b-c341ea537caf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-14775 does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework version 9.52.21-p4+tuxcare is not affected by CVE-2017-14775. The vulnerability (timing attack via non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 9.52.21, released years later, already contains this fix. Both DatabaseUserProvider.php and Eloque...", "justification": "code_not_present" } }, { "id": "CVE-2018-15133", "affects": [ { "ref": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } ], "bom-ref": "urn:uuid:25edffec-d39d-5923-87f6-7eaf883a4a01", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15133 affects version 9.52.21-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2019-9081", "affects": [ { "ref": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } ], "bom-ref": "urn:uuid:eb8890ea-ca78-5b5c-8d10-5c38d8838e53", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-9081 affects version 9.52.21-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2020-19316", "affects": [ { "ref": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } ], "bom-ref": "urn:uuid:a51ac414-3b37-5298-9452-8ee10c272817", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-19316 affects version 9.52.21-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2020-24941", "affects": [ { "ref": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } ], "bom-ref": "urn:uuid:46cd7648-24fe-5c67-82d2-fb49000e845e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-24941 affects version 9.52.21-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2021-21263", "affects": [ { "ref": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } ], "bom-ref": "urn:uuid:af9f14f3-707f-5705-9fdb-c1dd6a6184f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-21263 affects version 9.52.21-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2021-43808", "affects": [ { "ref": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } ], "bom-ref": "urn:uuid:60b3f444-1ca4-5195-8e27-fb5ceb1f4375", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-43808 does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework 9.52.21 is not affected by CVE-2021-43808. The vulnerability fix (random per-request salt for parent placeholder hashing in Blade templates) was already present in the upstream Laravel 9.52.21 release when TuxCare onboarded it. The vulnerable pattern (predictable parent placeholder hash based solely on sha1($section)) is not present in the codebase.", "justification": "code_not_present" } }, { "id": "CVE-2024-52301", "affects": [ { "ref": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } ], "bom-ref": "urn:uuid:3d5daf62-c15a-59c4-aaca-7a499e3c4a09", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52301 affects version 9.52.21-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2025-27515", "affects": [ { "ref": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } ], "bom-ref": "urn:uuid:4bc7ddd9-5344-5f47-b143-c4ad1b4c0311", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27515 is fixed in version 9.52.21-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2026-102279", "affects": [ { "ref": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } ], "bom-ref": "urn:uuid:79d9219d-54f1-5cea-adf8-87cfd6dad3fe", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-102279 does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-102279. The vulnerability concerns XSS via Tippy.js tooltips with allowHTML:true in Laravel 12.x's new exception renderer component. This component does not exist in Laravel 9.52.21, which uses Whoops or Symfony's HtmlErrorRenderer for exception display instead. Exhaustive searches found no tippy.js, allowHTML, or formatted-source.blade.php in the tar...", "justification": "code_not_present" } }, { "id": "CVE-2026-114508", "affects": [ { "ref": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } ], "bom-ref": "urn:uuid:7d3c97b2-048d-5c3b-9245-84c5b2406116", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114508 does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resource implementation (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 12.x. Version 9.52.21 predates this feature entirely\u2014the JsonApi namespace, related classes, and the vulnerable include parameter processing mechanism do not exist in this version. The target cannot...", "justification": "code_not_present" } }, { "id": "CVE-2026-114509", "affects": [ { "ref": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } ], "bom-ref": "urn:uuid:ae46f2a3-98f3-5bbc-8c75-9b6eaede55c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-114509 is fixed in version 9.52.21-p4+tuxcare of laravel/framework." } }, { "id": "GHSA-4mg9-vhxq-vm7j", "affects": [ { "ref": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } ], "bom-ref": "urn:uuid:7b132d3e-e1f1-50c5-903f-3985ff08db11", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-4mg9-vhxq-vm7j affects version 9.52.21-p4+tuxcare of laravel/framework." } }, { "id": "GHSA-5vg9-5847-vvmq", "affects": [ { "ref": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } ], "bom-ref": "urn:uuid:0b6d8306-9ce5-56bf-b557-2bd97d436dca", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 9.52.21-p4+tuxcare of laravel/framework." } }, { "id": "GHSA-6jvx-8ch9-j2jr", "affects": [ { "ref": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } ], "bom-ref": "urn:uuid:32443b7d-80ae-5418-8b9d-cfbc8a39599f", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-6jvx-8ch9-j2jr (CVE-2018-15133). The vulnerability involves PHP object injection through cookie deserialization. The upstream Laravel team fixed this in version 5.6.30 (August 2018) by disabling serialization for all cookies. Laravel 9.52.21, released years later, includes this fix via the EncryptCookies middleware's `$serialize = false` default. The vuln...", "justification": "code_not_present" } }, { "id": "GHSA-7852-w36x-6mf6", "affects": [ { "ref": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } ], "bom-ref": "urn:uuid:0b61462e-f4f7-5c03-9f0a-2fcee63efb6d", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework v9.52.21 is NOT AFFECTED by GHSA-7852-w36x-6mf6. The vulnerability (missing IV length validation in Encrypter causing decryption to return false instead of throwing an exception on manipulated payloads) was fixed by the upstream vendor in March 2018. The fix is present in the target at src/Illuminate/Encryption/Encrypter.php:246, where validPayload() validates that the base64-...", "justification": "code_not_present" } }, { "id": "GHSA-crmm-hgp2-wgrp", "affects": [ { "ref": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } ], "bom-ref": "urn:uuid:4bbeec32-93b6-529d-be10-9af1beeba09f", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 9.x.", "justification": "code_not_present" } }, { "id": "GHSA-jwvj-pwww-3mj5", "affects": [ { "ref": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } ], "bom-ref": "urn:uuid:b5c761fc-f0ce-5e1a-aa23-a6bf84043db3", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 9.52.21-p4+tuxcare is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable code pattern (uncontrolled array inputs causing unexpected query bindings) is not present because the upstream Laravel 9.52.21 release already contained all necessary fixes before TuxCare's snapshot import. The target implements the same defenses as the vendor patches: flattenValue() method normalizes array inputs...", "justification": "code_not_present" } }, { "id": "GHSA-qm5c-m76r-2hfr", "affects": [ { "ref": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } ], "bom-ref": "urn:uuid:d592144c-5ae4-5426-9cc3-8ae343d1e4dc", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 9.52.21-p4+tuxcare of laravel/framework." } }, { "id": "GHSA-wq8p-mqvg-2p5h", "affects": [ { "ref": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } ], "bom-ref": "urn:uuid:efddd8eb-82ea-575e-b57d-4964506b2c47", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 9.52.21-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v9.52.21-p4+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL injection via limit/offset in SQL Server). The vulnerability pattern is not present because the fix was already included in the upstream Laravel v9.52.21 release that TuxCare onboarded. All required protections are in place: integer casting in Builder.php limit()/offset() methods and SqlServerGrammar.ph...", "justification": "code_not_present" } }, { "id": "GHSA-x7p5-p2c9-phvg", "affects": [ { "ref": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } ], "bom-ref": "urn:uuid:b2860a4e-8769-5fd8-beb9-f041fcded164", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 9.52.21-p4+tuxcare of laravel/framework." } } ], "dependencies": [ { "ref": "pkg:composer/laravel/framework@9.52.21-p4+tuxcare" } ] }