{ "@id": "urn:uuid:f936cda8-8260-499b-bf76-b8a3a312976f", "role": "Document Creator", "author": "https://tuxcare.com", "version": 25, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T19:06:21.269800+00:00", "statements": [ { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10659 is fixed in version 6.20.45-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "AIKIDO-2026-10659" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-14775 does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-14775" }, "impact_statement": "not_affected \u2014 CVE-2017-14775 affects Laravel before 5.5.10 due to non-constant-time token comparison in remember_me token verification. The target (Laravel 6.20.45-p6+tuxcare) is NOT AFFECTED because the vendor fix was already present in the upstream Laravel 6.20.45 release. Both DatabaseUserProvider and EloquentUserProvider use hash_equals() for constant-time comparison, eliminating the timing side-channel ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:45:39.779746+00:00", "status_notes": "Vulnerability CVE-2018-15133 does not affect version 6.20.45-p3+tuxcare of laravel/framework. CVE-2018-15133 is NOT present in Laravel 6.20.45-p6+tuxcare. The vulnerability (RCE via unserialize on X-XSRF-TOKEN) was fixed in upstream Laravel 5.6.30/5.5.41 (August 2018) by disabling cookie serialization. The fix (protected static $serialize = false; using static::serialized() in decrypt calls) was already present when Laravel 6.20.45 was released and onboarded by TuxCare. The vulnerable code pattern does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15133" }, "impact_statement": "CVE-2018-15133 is NOT present in Laravel 6.20.45-p6+tuxcare. The vulnerability (RCE via unserialize on X-XSRF-TOKEN) was fixed in upstream Laravel 5.6.30/5.5.41 (August 2018) by disabling cookie serialization. The fix (protected static $serialize = false; using static::serialized() in decrypt calls) was already present when Laravel 6.20.45 was released and onboarded by TuxCare. The vulnerable code pattern does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-28T18:16:23.572849+00:00", "status_notes": "Vulnerability CVE-2019-9081 affects version 6.20.45-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "CVE-2019-9081" }, "action_statement": "Vulnerability CVE-2019-9081 affects version 6.20.45-p3+tuxcare of laravel/framework." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2020-19316 does not affect version 6.20.45-p3+tuxcare of laravel/framework. The target Laravel Framework 6.20.45 is NOT vulnerable to CVE-2020-19316. The vulnerable code pattern (unescaped parameters in Windows mklink exec call) is not present. The fix using escapeshellarg() was already included in the upstream Laravel v6.20.45 release that TuxCare onboarded. The vulnerability affected Laravel before 5.8.17 (patched May 2019), and version 6.20.45 already contains the upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-19316" }, "impact_statement": "The target Laravel Framework 6.20.45 is NOT vulnerable to CVE-2020-19316. The vulnerable code pattern (unescaped parameters in Windows mklink exec call) is not present. The fix using escapeshellarg() was already included in the upstream Laravel v6.20.45 release that TuxCare onboarded. The vulnerability affected Laravel before 5.8.17 (patched May 2019), and version 6.20.45 already contains the upstream fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:42:21.835037+00:00", "status_notes": "Vulnerability CVE-2020-24941 does not affect version 6.20.45-p3+tuxcare of laravel/framework. The target Laravel framework version 6.20.45-p6+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability (mass assignment bypass via non-existent column names) was fixed in upstream Laravel v6.18.35 (commit 897d107775 by Taylor Otwell). The target version 6.20.45 already contains this fix, which validates that attribute keys exist as actual database columns via the isGuardableColumn() method. The fix was shipped in the upstream release and onboarded to TuxCare via snapshot commit abbc62d18a. The vulnerable pattern (allowing mass assignment to arbitrary non-column attributes) is not present in the target code.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-24941" }, "impact_statement": "The target Laravel framework version 6.20.45-p6+tuxcare is NOT AFFECTED by CVE-2020-24941. The vulnerability (mass assignment bypass via non-existent column names) was fixed in upstream Laravel v6.18.35 (commit 897d107775 by Taylor Otwell). The target version 6.20.45 already contains this fix, which validates that attribute keys exist as actual database columns via the isGuardableColumn() method. The fix was shipped in the upstream release and onboarded to TuxCare via snapshot commit abbc62d18a. The vulnerable pattern (allowing mass assignment to arbitrary non-column attributes) is not present in the target code." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:43:43.097163+00:00", "status_notes": "Vulnerability CVE-2021-21263 does not affect version 6.20.45-p3+tuxcare of laravel/framework. CVE-2021-21263 affects Laravel versions <6.20.12. The target is version 6.20.45, which includes the upstream fix that prevents query binding exploitation. The vulnerability allowed array values to be passed to query builder methods where scalar values were expected, causing incorrect binding counts and corrupted query results. The target contains comprehensive protections using a `flattenValue()` helper method across all affected methods (where, having, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, whereBetween). The fix was present in the upstream v6.20.45 release and was imported via TuxCare's snapshot commit abbc62d18a, with no subsequent modifications to the query builder.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21263" }, "impact_statement": "CVE-2021-21263 affects Laravel versions <6.20.12. The target is version 6.20.45, which includes the upstream fix that prevents query binding exploitation. The vulnerability allowed array values to be passed to query builder methods where scalar values were expected, causing incorrect binding counts and corrupted query results. The target contains comprehensive protections using a `flattenValue()` helper method across all affected methods (where, having, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, whereBetween). The fix was present in the upstream v6.20.45 release and was imported via TuxCare's snapshot commit abbc62d18a, with no subsequent modifications to the query builder." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 6.20.45-p3+tuxcare.", "vulnerability": { "name": "CVE-2021-43617" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:30:41.069534+00:00", "status_notes": "Vulnerability CVE-2021-43808 does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-43808" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework 6.20.45-p6+tuxcare) is NOT AFFECTED by CVE-2021-43808. The vulnerability involves predictable parent placeholder tokens in Blade templates that could be guessed by attackers to inject XSS payloads. However, the complete fix (per-request random salt in placeholder generation) was already present in the upstream Laravel 6.20.45 release that TuxCare onboard..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:44:10.208770+00:00", "status_notes": "Vulnerability CVE-2024-52301 does not affect version 6.20.45-p3+tuxcare of laravel/framework. The target repository (Laravel framework 6.20.45-p6+tuxcare) is not affected by CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled, allowing attackers to control environment detection through $_SERVER['argv']. The fix adds a runningInConsole() check before using argv values. This fix was already present in the upstream Laravel v6.20.45 release (authored by Taylor Otwell, taylor@laravel.com, Nov 2024) before TuxCare created their snapshot. The TuxCare branch started from a snapshot of v6.20.45 (commit abbc62d18a) which already contained the fixed code. No TuxCare backport was necessary as the vulnerable code pattern never existed in this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52301" }, "impact_statement": "The target repository (Laravel framework 6.20.45-p6+tuxcare) is not affected by CVE-2024-52301. The vulnerability involves environment manipulation via crafted query strings when register_argc_argv is enabled, allowing attackers to control environment detection through $_SERVER['argv']. The fix adds a runningInConsole() check before using argv values. This fix was already present in the upstream Laravel v6.20.45 release (authored by Taylor Otwell, taylor@laravel.com, Nov 2024) before TuxCare created their snapshot. The TuxCare branch started from a snapshot of v6.20.45 (commit abbc62d18a) which already contained the fixed code. No TuxCare backport was necessary as the vulnerable code pattern never existed in this branch." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27515 does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27515" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2025-27515. The vulnerability requires the Rules\\File, Rules\\Password, and Rules\\Email custom validation rule classes introduced in Laravel 8+. Laravel 6 uses a fundamentally different validation architecture with built-in validators (validateFile, validateMimes, etc.) that do not exhibit the attribute name confusion flaw." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-09-29T20:36:58.499788+00:00", "status_notes": "Vulnerability CVE-2026-102279 does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-102279" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by CVE-2026-102279. This version uses the Whoops library (PrettyPageHandler) for exception rendering when APP_DEBUG=true, not the custom exception renderer with Tippy.js tooltips introduced in Laravel 12.x. The vulnerability requires Tippy.js tooltips configured with allowHTML: true, but no Tippy.js library or tooltip mechanism exists in this version. The vulnera..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2026-114508 does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114508" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is not affected by CVE-2026-114508. The vulnerability exists in Laravel's JSON:API resources feature, which was introduced in Laravel 12.x. The target version predates this feature by 6 major versions and contains none of the vulnerable code paths. Comprehensive searches confirm no JSON:API infrastructure exists: no ResolvesJsonApiElements trait, no JsonApi..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-11-04T11:46:15.891205+00:00", "status_notes": "Vulnerability CVE-2026-114509 affects version 6.20.45-p3+tuxcare of laravel/framework, and is fixed in 6.20.45-p7+tuxcare.", "vulnerability": { "name": "CVE-2026-114509" }, "action_statement": "Vulnerability CVE-2026-114509 affects version 6.20.45-p3+tuxcare of laravel/framework, and is fixed in 6.20.45-p7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-11-13T19:06:21.269800+00:00", "status_notes": "Vulnerability CVE-2026-128083 does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 Target is laravel/framework 6.20.45. The vulnerable Illuminate\\Concurrency component (Concurrency::run, process driver that parses child stdout as a framework result message) does not exist in this version, so the forged-result-message chain cannot occur.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-128083" }, "impact_statement": "not_affected \u2014 Target is laravel/framework 6.20.45. The vulnerable Illuminate\\Concurrency component (Concurrency::run, process driver that parses child stdout as a framework result message) does not exist in this version, so the forged-result-message chain cannot occur." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-28T20:50:01.681995+00:00", "status_notes": "Vulnerability GHSA-4mg9-vhxq-vm7j does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4mg9-vhxq-vm7j" }, "impact_statement": "not_affected \u2014 Target version 6.20.45 is NOT affected by GHSA-4mg9-vhxq-vm7j (SQL Server LIMIT/OFFSET SQL injection). The vulnerability pattern is not present because the fix was already included in upstream Laravel 6.20.45 (released after the patched version 6.20.26). The target code contains robust defenses: (1) Builder.php casts limit/offset values to integers via (int) when setting them, and (2) SqlServer..." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 6.20.45-p3+tuxcare of laravel/framework.", "vulnerability": { "name": "GHSA-5vg9-5847-vvmq" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:05:58.501817+00:00", "status_notes": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6jvx-8ch9-j2jr" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 (the upstream version TuxCare snapshotted) was released long after the security fix in Laravel 5.6.30 (August 2018). The vulnerable pattern (PHP serialization of cookie values enabling object injection attacks) is not present in the target code. All cookies are encrypted/decrypted with serialization disabled, preventing PHP object injection through cookie deserialization." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-7852-w36x-6mf6" }, "impact_statement": "not_affected \u2014 The target repository (Laravel Framework v6.20.45-p6+tuxcare) is not affected by GHSA-7852-w36x-6mf6. The vulnerability concerns missing IV length validation in the Encrypter component that could cause decryption to return `false` instead of throwing an exception, enabling type-confusion attacks with weak comparisons. The fix (IV length validation) was already present in the upstream Laravel v6..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-crmm-hgp2-wgrp" }, "impact_statement": "not_affected \u2014 Laravel 6.20.45 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability concerns LocalFilesystemAdapter's temporaryUrl() and temporaryUploadUrl() methods that create signed routes with inadequately encoded file paths. This class and feature do not exist in Laravel 6.x - they were introduced in Laravel 11.x. The target's FilesystemAdapter throws a RuntimeException when attempting to create tem..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability GHSA-jwvj-pwww-3mj5 does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jwvj-pwww-3mj5" }, "impact_statement": "not_affected \u2014 The target Laravel 6.20.45-p6+tuxcare is NOT affected by GHSA-jwvj-pwww-3mj5 (array binding exploitation). All vulnerable query builder methods contain proper defensive code that flattens array inputs and limits bindings. The fix was already present in the upstream Laravel 6.20.45 release (Nov 2024) before TuxCare onboarding, originating from upstream patches by Kane Cohen and Taylor Otwell (Ja..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:19:00.105438+00:00", "status_notes": "Vulnerability GHSA-qm5c-m76r-2hfr does not affect version 6.20.45-p3+tuxcare of laravel/framework. Laravel Framework 6.20.45 is not affected by GHSA-qm5c-m76r-2hfr (encryption oracle RCE via cookie session driver). The vulnerability was fixed by upstream Laravel in version 6.18.31 on July 27, 2020, by replacing predictable SHA1 hash prefixes with keyed HMAC values in cookie encryption. Version 6.20.45 was released after this fix and already includes the CookieValuePrefix class with hash_hmac() implementation. The target contains the secure code pattern, not the vulnerable one.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-qm5c-m76r-2hfr" }, "impact_statement": "Laravel Framework 6.20.45 is not affected by GHSA-qm5c-m76r-2hfr (encryption oracle RCE via cookie session driver). The vulnerability was fixed by upstream Laravel in version 6.18.31 on July 27, 2020, by replacing predictable SHA1 hash prefixes with keyed HMAC values in cookie encryption. Version 6.20.45 was released after this fix and already includes the CookieValuePrefix class with hash_hmac() implementation. The target contains the secure code pattern, not the vulnerable one." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability GHSA-wq8p-mqvg-2p5h does not affect version 6.20.45-p3+tuxcare of laravel/framework. not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wq8p-mqvg-2p5h" }, "impact_statement": "not_affected \u2014 Target laravel/framework v6.20.45-p6+tuxcare is NOT AFFECTED by GHSA-wq8p-mqvg-2p5h (SQL Server limit/offset SQL injection). The vulnerability was patched in upstream Laravel v6.20.26, and the target version v6.20.45 already contains the complete fix from upstream. All defenses (is_numeric() validation + integer casting in SqlServerGrammar.php and Builder.php) are present in the onboarded upstr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare", "identifiers": { "purl": "pkg:composer/laravel/framework@6.20.45-p3+tuxcare" } } ], "timestamp": "2026-10-31T20:42:21.835037+00:00", "status_notes": "Vulnerability GHSA-x7p5-p2c9-phvg does not affect version 6.20.45-p3+tuxcare of laravel/framework. The target repository (Laravel 6.20.45) is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involving unexpected query bindings from array values has already been fixed in the upstream Laravel release v6.20.11 (Jan 13, 2021) and v6.20.14 (Jan 21, 2021), which were released well before v6.20.45. All query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the `flattenValue()` helper method to extract scalar values from array inputs, preventing the SQL binding mismatch vulnerability. The fix was authored by Taylor Otwell for the upstream Laravel framework and was included in the v6.20.45 release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-x7p5-p2c9-phvg" }, "impact_statement": "The target repository (Laravel 6.20.45) is not affected by GHSA-x7p5-p2c9-phvg. The vulnerability involving unexpected query bindings from array values has already been fixed in the upstream Laravel release v6.20.11 (Jan 13, 2021) and v6.20.14 (Jan 21, 2021), which were released well before v6.20.45. All query builder methods (where, whereBetween, whereDate, whereTime, whereDay, whereMonth, whereYear, whereJsonLength, having, havingBetween) use the `flattenValue()` helper method to extract scalar values from array inputs, preventing the SQL binding mismatch vulnerability. The fix was authored by Taylor Otwell for the upstream Laravel framework and was included in the v6.20.45 release that TuxCare onboarded." } ] }