{ "@id": "urn:uuid:950fbba4-b18b-4a07-b4e7-5c832d8e4b43", "role": "Document Creator", "author": "https://tuxcare.com", "version": 17, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-29T00:51:30.888148+00:00", "statements": [ { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 6.20.45-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 6.20.45-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 6.20.45-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 6.20.45-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 6.20.45-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 6.20.45-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 6.20.45-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 6.20.45-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 6.20.45-p4+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2021-21263 affects version 6.20.45-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" }, "action_statement": "Vulnerability CVE-2021-21263 affects version 6.20.45-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 6.20.45-p4+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:30:41.069534+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2024-52301 affects version 6.20.45-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" }, "action_statement": "Vulnerability CVE-2024-52301 affects version 6.20.45-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-09-29T20:36:58.499788+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-22T10:40:15.599189+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 6.20.45-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 6.20.45-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T20:50:01.681995+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 6.20.45-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:05:58.501817+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 6.20.45-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 6.20.45-p4+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 6.20.45-p4+tuxcare of laravel/framework. not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p4+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 6.20.45-p4+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "action_statement": "Vulnerability GHSA-x7p5-p2c9-phvg affects version 6.20.45-p4+tuxcare of laravel/framework." } ] }