Login Request a demo
Medium severity · published Dec 8, 2021
CVE-2021-43808
Laravel is a web application framework
6.1
CVSS
0.8%
EPSS
No
On KEV
Description
Laravel is a web application framework. Laravel prior to versions 8.75.0, 7.30.6, and 6.20.42 contain a possible cross-site scripting (XSS) vulnerability in the Blade templating engine. A broken HTML element may be clicked and the user taken to another location in their browser due to XSS. This is due to the user being able to guess the parent placeholder SHA-1 hash by trying common names of sections. If the parent template contains an exploitable HTML structure an XSS vulnerability can be exposed. This vulnerability has been patched in versions 8.75.0, 7.30.6, and 6.20.42 by determining the parent placeholder at runtime and using a random hash that is unique to each request.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
Framework · Laravel
before 6.20.42; 7.0.0 before 7.30.6; 8.0.0 before 8.75.0 · source: NVD
Affected product
FR
Framework
Laravel
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-43808
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-43808
Patch
https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b
Patch
https://github.com/laravel/framework/pull/39906
Patch
https://github.com/laravel/framework/pull/39908
Patch
https://github.com/laravel/framework/pull/39909
Release Notes
https://github.com/laravel/framework/releases/tag/v6.20.42
Release Notes
https://github.com/laravel/framework/releases/tag/v7.30.6
More from Framework
9.8
CVE-2025-27515
Laravel is a web application framework
9.8
CVE-2021-43617
Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for…
9.2
CVE-2026-114509
Laravel TokenGuard authentication bypass through non-string API credentials
8.9
CVE-2026-48019
CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay
8.8
CVE-2020-19316
OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17