{ "@id": "urn:uuid:aeb08523-b017-4a1b-8f29-f737aeddd976", "role": "Document Creator", "author": "https://tuxcare.com", "version": 12, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-29T00:44:47.675175+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 8.12.1-p3+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 does not affect Laravel 8.12.1-p5+tuxcare. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017), and the fix was already present in the upstream Laravel 8.12.1 release (December 2020) that TuxCare onboarded. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison, preventing...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 does not affect Laravel 8.12.1-p5+tuxcare. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel 5.5.10 (September 2017), and the fix was already present in the upstream Laravel 8.12.1 release (December 2020) that TuxCare onboarded. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time token comparison, preventing..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:19:25.587923+00:00", "status_notes": "Vulnerability CVE-2018-15133 affects version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2018-15133" }, "action_statement": "Vulnerability CVE-2018-15133 affects version 8.12.1-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 8.12.1-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2020-19316 affects version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-19316" }, "action_statement": "Vulnerability CVE-2020-19316 affects version 8.12.1-p3+tuxcare of laravel/framework." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability CVE-2020-24941 affects version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2020-24941" }, "action_statement": "Vulnerability CVE-2020-24941 affects version 8.12.1-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-21263 is fixed in version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-21263" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.1-p3+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-43808 is fixed in version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2021-43808" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52301 is fixed in version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2024-52301" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-29T20:23:00.156586+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 8.12.1-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer that uses Tippy.js tooltips with allowHTML enabled. Laravel 8.x uses a completely different exception rendering system (Whoops library from filp/whoops) and does not contain the vulnerable code. The Tippy.js-based exception renderer infrastructure does not exist in this versio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-102279. The vulnerability exists in Laravel 12.x's custom exception renderer that uses Tippy.js tooltips with allowHTML enabled. Laravel 8.x uses a completely different exception rendering system (Whoops library from filp/whoops) and does not contain the vulnerable code. The Tippy.js-based exception renderer infrastructure does not exist in this versio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:44:47.675175+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 8.12.1-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 11/12. Version 8.12.1 predates this feature entirely - it only has basic JsonResource with no include parameter processing or relationship compilation logic. The entire vulnerable code path is absent f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resource system (specifically the ResolvesJsonApiElements trait), which was introduced in Laravel 11/12. Version 8.12.1 predates this feature entirely - it only has basic JsonResource with no include parameter processing or relationship compilation logic. The entire vulnerable code path is absent f..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-10-22T10:38:51.865623+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 8.12.1-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33347 does not affect version 8.12.1-p3+tuxcare of laravel/framework. CVE-2026-33347 in league/commonmark 1.6.7 is not affected. Refer to league/commonmark 1.6.7 for details.", "vulnerability": { "name": "CVE-2026-33347" }, "impact_statement": "CVE-2026-33347 in league/commonmark 1.6.7 is not affected. Refer to league/commonmark 1.6.7 for details." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:53:45.635911+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.1-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via unsafe cookie deserialization). The vulnerability affected Laravel 5.6.x prior to 5.6.30 and was fixed in August 2018 by disabling cookie serialization. Laravel 8.12.1 (released December 2020) already contains the fix in its upstream release: `protected static $serialize = false` in EncryptCookies.php globally disab...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via unsafe cookie deserialization). The vulnerability affected Laravel 5.6.x prior to 5.6.30 and was fixed in August 2018 by disabling cookie serialization. Laravel 8.12.1 (released December 2020) already contains the fix in its upstream release: `protected static $serialize = false` in EncryptCookies.php globally disab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.1-p3+tuxcare of laravel/framework. not_affected \u2014 The Laravel Encrypter IV length validation vulnerability (GHSA-7852-w36x-6mf6) is NOT present in this target. The fix was included in upstream Laravel 8.12.1 (released December 2020) and imported via snapshot commit 4993dfe2ac. The validPayload method at lines 211-215 of src/Illuminate/Encryption/Encrypter.php contains the exact IV length validation (line 214: strlen(base64_decode($payload['iv'...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The Laravel Encrypter IV length validation vulnerability (GHSA-7852-w36x-6mf6) is NOT present in this target. The fix was included in upstream Laravel 8.12.1 (released December 2020) and imported via snapshot commit 4993dfe2ac. The validPayload method at lines 211-215 of src/Illuminate/Encryption/Encrypter.php contains the exact IV length validation (line 214: strlen(base64_decode($payload['iv'..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.1-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns ambiguous URL parsing in local filesystem temporary signed URLs, but Laravel 8.x does not have the local filesystem signed URL feature. The temporaryUrl() method throws RuntimeException for local storage adapters. This feature was introduced in Laravel 11+/12.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 8.12.1 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns ambiguous URL parsing in local filesystem temporary signed URLs, but Laravel 8.x does not have the local filesystem signed URL feature. The temporaryUrl() method throws RuntimeException for local storage adapters. This feature was introduced in Laravel 11+/12.x." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" } }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:14:49.853815+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "action_statement": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.1-p3+tuxcare of laravel/framework." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@8.12.1-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.1-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" } } ] }