{ "@id": "urn:uuid:4168d49f-6d37-4d75-8970-bc2c95fed388", "role": "Document Creator", "author": "https://tuxcare.com", "version": 27, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T19:07:00.085664+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 10.48.28-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 is not affected by CVE-2017-14775. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel v5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 10.48.28 inherited this fix from upstream - both DatabaseUserProvider and EloquentUserProvider use hash_equals() for token verification. The fix was autho...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28 is not affected by CVE-2017-14775. The vulnerability (non-constant-time remember_me token comparison) was fixed in Laravel v5.5.10 (September 2017) by introducing hash_equals() for constant-time comparison. The target version 10.48.28 inherited this fix from upstream - both DatabaseUserProvider and EloquentUserProvider use hash_equals() for token verification. The fix was autho..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:45:11.789246+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 10.48.28-p2+tuxcare of laravel/framework. CVE-2018-15133 (RCE via unserialize on X-XSRF-TOKEN) is not present in Laravel 10.48.28. The vulnerability was fixed by Laravel upstream in August 2018 (commit 240d904606 by Taylor Otwell). The fix disables PHP serialization during cookie decryption by setting `static $serialize = false` and passing this value to all decrypt() calls. This protection was already present in Laravel 10.48.28 when TuxCare onboarded the version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 (RCE via unserialize on X-XSRF-TOKEN) is not present in Laravel 10.48.28. The vulnerability was fixed by Laravel upstream in August 2018 (commit 240d904606 by Taylor Otwell). The fix disables PHP serialization during cookie decryption by setting `static $serialize = false` and passing this value to all decrypt() calls. This protection was already present in Laravel 10.48.28 when TuxCare onboarded the version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:44:40.573037+00:00", "status_notes": "Vulnerability CVE-2019-9081 does not affect version 10.48.28-p2+tuxcare of laravel/framework. Laravel Framework 10.48.28 is not affected by CVE-2019-9081. While the PendingCommand class with a dangerous __destruct method exists, there is no reachable attack path. Cookie serialization is disabled by default (EncryptCookies::$serialize = false), and all other deserialization entry points (sessions, cache, queues) use server-side storage not controllable via HTTP requests. The vulnerability pattern cannot be triggered by attacker-controlled input in normal production usage.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2019-9081" }, "impact_statement": "Laravel Framework 10.48.28 is not affected by CVE-2019-9081. While the PendingCommand class with a dangerous __destruct method exists, there is no reachable attack path. Cookie serialization is disabled by default (EncryptCookies::$serialize = false), and all other deserialization entry points (sessions, cache, queues) use server-side storage not controllable via HTTP requests. The vulnerability pattern cannot be triggered by attacker-controlled input in normal production usage." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:43:15.621975+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 10.48.28-p2+tuxcare of laravel/framework. CVE-2020-19316 affects Laravel Framework before version 5.8.17 (OS command injection via unescaped parameters in Filesystem::link()). The target repository is laravel/framework version 10.48.28-p3+tuxcare. Analysis confirms the fix (escapeshellarg() wrapping of both $target and $link parameters) is present at line 360 of src/Illuminate/Filesystem/Filesystem.php. Git blame shows this line originates from commit ae86934b - TuxCare's initial snapshot of upstream v10.48.28. The original upstream fix was committed by Taylor Otwell (taylor@laravel.com) in May 2019 as commit 44c3feb604. Since version 10.48.28 was released years after the 5.8.17 fix, the vulnerable code pattern never existed in this target version - the fix shipped with the upstream release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "CVE-2020-19316 affects Laravel Framework before version 5.8.17 (OS command injection via unescaped parameters in Filesystem::link()). The target repository is laravel/framework version 10.48.28-p3+tuxcare. Analysis confirms the fix (escapeshellarg() wrapping of both $target and $link parameters) is present at line 360 of src/Illuminate/Filesystem/Filesystem.php. Git blame shows this line originates from commit ae86934b - TuxCare's initial snapshot of upstream v10.48.28. The original upstream fix was committed by Taylor Otwell (taylor@laravel.com) in May 2019 as commit 44c3feb604. Since version 10.48.28 was released years after the 5.8.17 fix, the vulnerable code pattern never existed in this target version - the fix shipped with the upstream release that TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:41:35.131174+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 10.48.28-p2+tuxcare of laravel/framework. CVE-2020-24941 affects Laravel before 6.18.35 and 7.x before 7.24.0. The target is Laravel v10.48.28, which already contains the upstream fix. The GuardsAttributes trait includes the isGuardableColumn() method that validates attribute keys against actual database columns, preventing mass assignment bypass via crafted JSON path expressions or non-existent column names. The fix was present in the upstream Laravel v10.48.28 release that TuxCare onboarded via snapshot commit ae86934b on 2025-10-06, not applied as a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "CVE-2020-24941 affects Laravel before 6.18.35 and 7.x before 7.24.0. The target is Laravel v10.48.28, which already contains the upstream fix. The GuardsAttributes trait includes the isGuardableColumn() method that validates attribute keys against actual database columns, preventing mass assignment bypass via crafted JSON path expressions or non-existent column names. The fix was present in the upstream Laravel v10.48.28 release that TuxCare onboarded via snapshot commit ae86934b on 2025-10-06, not applied as a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:42:49.287382+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 10.48.28-p2+tuxcare of laravel/framework. CVE-2021-21263 affects Laravel versions <6.20.12, <7.30.3, and <8.22.1. The target (Laravel 10.48.28-p3+tuxcare) is not affected because the upstream Laravel 10.48.28 release already contains the fix. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) use the flattenValue() method or array_slice() to prevent array values from adding unexpected query bindings. This protection was shipped in the upstream release and imported via TuxCare's snapshot commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "CVE-2021-21263 affects Laravel versions <6.20.12, <7.30.3, and <8.22.1. The target (Laravel 10.48.28-p3+tuxcare) is not affected because the upstream Laravel 10.48.28 release already contains the fix. All vulnerable query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having) use the flattenValue() method or array_slice() to prevent array values from adding unexpected query bindings. This protection was shipped in the upstream release and imported via TuxCare's snapshot commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 10.48.28-p2+tuxcare of laravel/framework. not_affected \u2014 CVE-2021-43808 (Blade XSS via predictable parent placeholder) is not present in the target. The security fix was already included in upstream Laravel 10.48.28, which TuxCare onboarded. The target implements all three security components: random salt generation (using cryptographically secure random_bytes()), runtime placeholder computation, and cache-busting 'v2' prefix. The vulnerability was o...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 CVE-2021-43808 (Blade XSS via predictable parent placeholder) is not present in the target. The security fix was already included in upstream Laravel 10.48.28, which TuxCare onboarded. The target implements all three security components: random salt generation (using cryptographically secure random_bytes()), runtime placeholder computation, and cache-busting 'v2' prefix. The vulnerability was o..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 10.48.28-p2+tuxcare of laravel/framework. Target version 10.48.28 is NOT AFFECTED by CVE-2024-52301. The vulnerability was fixed by Laravel upstream in v10.48.23 (November 12, 2024) via commit 8c07b6301b2a177a34ee5fdbca11443e3e541a15 authored by Taylor Otwell. The fix was already present in the upstream v10.48.28 release when TuxCare onboarded it on October 6, 2024. The target's detectEnvironment() method correctly blocks argv-based environment manipulation in non-CLI contexts by checking runningInConsole() before using $_SERVER['argv'].", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "Target version 10.48.28 is NOT AFFECTED by CVE-2024-52301. The vulnerability was fixed by Laravel upstream in v10.48.23 (November 12, 2024) via commit 8c07b6301b2a177a34ee5fdbca11443e3e541a15 authored by Taylor Otwell. The fix was already present in the upstream v10.48.28 release when TuxCare onboarded it on October 6, 2024. The target's detectEnvironment() method correctly blocks argv-based environment manipulation in non-CLI contexts by checking runningInConsole() before using $_SERVER['argv']." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 is fixed in version 10.48.28-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2025-27515" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-09-29T20:29:00.136561+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 10.48.28-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 is not affected by CVE-2026-102279. The vulnerability targets Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in Laravel 12.x. Laravel 10.x uses a completely different exception rendering architecture (Whoops PrettyPageHandler and Symfony HtmlErrorRenderer) that does not include JavaScript tooltips or the vulnerable allowHTML:true configuration....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28 is not affected by CVE-2026-102279. The vulnerability targets Laravel's custom exception renderer with Tippy.js tooltips, which was introduced in Laravel 12.x. Laravel 10.x uses a completely different exception rendering architecture (Whoops PrettyPageHandler and Symfony HtmlErrorRenderer) that does not include JavaScript tooltips or the vulnerable allowHTML:true configuration...." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 10.48.28-p2+tuxcare of laravel/framework. not_affected \u2014 The target version (laravel/framework 10.48.28) is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resources feature, which was introduced in version 12.x (December 2025). Version 10.48.28 predates this feature entirely - the vulnerable code (ResolvesJsonApiElements trait) and the entire JsonApi module do not exist in v10.x. The target uses standard JSON resource...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 The target version (laravel/framework 10.48.28) is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API Resources feature, which was introduced in version 12.x (December 2025). Version 10.48.28 predates this feature entirely - the vulnerable code (ResolvesJsonApiElements trait) and the entire JsonApi module do not exist in v10.x. The target uses standard JSON resource..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-26T16:22:00.021432+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 10.48.28-p2+tuxcare of laravel/framework, and is fixed in 10.48.28-p3+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 10.48.28-p2+tuxcare of laravel/framework, and is fixed in 10.48.28-p3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-11-13T19:07:00.085664+00:00", "status_notes": "Vulnerability CVE-2026-128083 does not affect version 10.48.28-p2+tuxcare of laravel/framework. not_affected \u2014 The target is laravel/framework 10.48.28 (TuxCare build). The advisory concerns the Concurrency component (Concurrency::run() and its process driver), which was added in Laravel 11.x. That component is not in this tree, and no other code parses child-process stdout as a trusted result envelope. No patch was supplied, so this verdict rests on the CVE text and a code search.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-128083" }, "impact_statement": "not_affected \u2014 The target is laravel/framework 10.48.28 (TuxCare build). The advisory concerns the Concurrency component (Concurrency::run() and its process driver), which was added in Laravel 11.x. That component is not in this tree, and no other code parses child-process stdout as a trusted result envelope. No patch was supplied, so this verdict rests on the CVE text and a code search." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-28T20:45:12.375364+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 10.48.28-p2+tuxcare of laravel/framework. not_affected \u2014 The target Laravel Framework v10.48.28-p3+tuxcare is not affected by GHSA-4mg9-vhxq-vm7j (SQL Server limit/offset SQL injection). The vulnerability pattern is absent because the upstream fix was already included in Laravel v10.48.28, which was onboarded into the TuxCare branch. Integer casting protections are present in both Builder.php (limit/offset/skip/take methods) and SqlServerGrammar.php ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 The target Laravel Framework v10.48.28-p3+tuxcare is not affected by GHSA-4mg9-vhxq-vm7j (SQL Server limit/offset SQL injection). The vulnerability pattern is absent because the upstream fix was already included in Laravel v10.48.28, which was onboarded into the TuxCare branch. Integer casting protections are present in both Builder.php (limit/offset/skip/take methods) and SqlServerGrammar.php ..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 10.48.28-p2+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:00:11.359241+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 10.48.28-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28-p3+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie deserialization). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling automatic serialization for all cookies. Laravel 10.48.28 was released in 2024, approximately 6 years after the fix, and the protection was already present in the upstream release that TuxCare onboarded. Th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28-p3+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie deserialization). The vulnerability was fixed in Laravel 5.6.30 (August 2018) by disabling automatic serialization for all cookies. Laravel 10.48.28 was released in 2024, approximately 6 years after the fix, and the protection was already present in the upstream release that TuxCare onboarded. Th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-11-06T11:19:00.067933+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 10.48.28-p2+tuxcare of laravel/framework. Already fixed upstream before 10.48.28 (GHSA-7852-w36x-6mf6 affects only <5.5.40 and 5.6.0-5.6.14; patched in 5.5.40/5.6.15, upstream commits 28e53f23a7/886d261df0, 2018-03-30): Encrypter::decrypt() throws DecryptException when openssl_decrypt returns false, and validPayload() enforces the IV length via openssl_cipher_iv_length. Vendor fix present in laravel/framework v10.48.28; Encrypter.php on tuxcare-current/10.48.28 (72a551b0e0) is identical to upstream. No TuxCare patch needed. Ref PHPELSCVE-991.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "Already fixed upstream before 10.48.28 (GHSA-7852-w36x-6mf6 affects only <5.5.40 and 5.6.0-5.6.14; patched in 5.5.40/5.6.15, upstream commits 28e53f23a7/886d261df0, 2018-03-30): Encrypter::decrypt() throws DecryptException when openssl_decrypt returns false, and validPayload() enforces the IV length via openssl_cipher_iv_length. Vendor fix present in laravel/framework v10.48.28; Encrypter.php on tuxcare-current/10.48.28 (72a551b0e0) is identical to upstream. No TuxCare patch needed. Ref PHPELSCVE-991." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 10.48.28-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 does not contain the vulnerable code path. The vulnerability (GHSA-crmm-hgp2-wgrp) affects Laravel 11+'s LocalFilesystemAdapter class, which was introduced in Laravel 11 and does not exist in Laravel 10. Laravel 10 uses a delegating architecture where FilesystemAdapter throws RuntimeException for local filesystem temporary URLs rather than implementing them.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28 does not contain the vulnerable code path. The vulnerability (GHSA-crmm-hgp2-wgrp) affects Laravel 11+'s LocalFilesystemAdapter class, which was introduced in Laravel 11 and does not exist in Laravel 10. Laravel 10 uses a delegating architecture where FilesystemAdapter throws RuntimeException for local filesystem temporary URLs rather than implementing them." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-28T21:13:18.978013+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 10.48.28-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel framework 10.48.28 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable pattern described in the advisory (unexpected query bindings when array values are passed where scalars are expected) is not present in this version. The upstream Laravel 10.48.28 release already included the complete fix, which normalizes array inputs to scalar values using the `flattenValue()` helper method and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 Laravel framework 10.48.28 is not affected by GHSA-jwvj-pwww-3mj5. The vulnerable pattern described in the advisory (unexpected query bindings when array values are passed where scalars are expected) is not present in this version. The upstream Laravel 10.48.28 release already included the complete fix, which normalizes array inputs to scalar values using the `flattenValue()` helper method and ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:16:05.248593+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 10.48.28-p2+tuxcare of laravel/framework. The target Laravel framework v10.48.28-p3+tuxcare is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (cookie encryption oracle vulnerability). The security fix replacing predictable SHA1 cookie prefixes with HMAC-based prefixes was already present in the upstream Laravel v10.48.28 release that TuxCare onboarded. The vulnerable code pattern does not exist in the current codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "The target Laravel framework v10.48.28-p3+tuxcare is NOT AFFECTED by GHSA-qm5c-m76r-2hfr (cookie encryption oracle vulnerability). The security fix replacing predictable SHA1 cookie prefixes with HMAC-based prefixes was already present in the upstream Laravel v10.48.28 release that TuxCare onboarded. The vulnerable code pattern does not exist in the current codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 10.48.28-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 10.48.28 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched by upstream Laravel in April 2021 (versions 6.20.26, 7.30.5, 8.40.0). Laravel 10.48.28, released in 2024, already contains all required integer casting defenses in SqlServerGrammar.php (is_numeric checks, int casts in compileColumns/compileLimit/compileOffset) and Build...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Laravel 10.48.28 is not affected by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched by upstream Laravel in April 2021 (versions 6.20.26, 7.30.5, 8.40.0). Laravel 10.48.28, released in 2024, already contains all required integer casting defenses in SqlServerGrammar.php (is_numeric checks, int casts in compileColumns/compileLimit/compileOffset) and Build..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@10.48.28-p2+tuxcare" } } ], "timestamp": "2026-10-31T20:41:42.263575+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 10.48.28-p2+tuxcare of laravel/framework. The target repository Laravel framework v10.48.28 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability fix (limiting query bindings from array inputs) was already included in the upstream Laravel 10.48.28 release. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the flattenValue() method to extract only the first element from array inputs, preventing binding manipulation attacks.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "The target repository Laravel framework v10.48.28 is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability fix (limiting query bindings from array inputs) was already included in the upstream Laravel 10.48.28 release. All vulnerable methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the flattenValue() method to extract only the first element from array inputs, preventing binding manipulation attacks." } ] }