High severity · published Sep 4, 2026
CVE-2026-48019
CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay
8.9
CVSS
0.5%
EPSS
No
On KEV
Description
Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patched in versions 12.60.0 and 13.10.0.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
framework · laravel
>= 13.0.0, < 13.10.0; < 12.60.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-48019
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-48019
github.com
https://github.com/laravel/framework/commit/96e9a663db657cf37ef26cd794fda8ff60eaa451
github.com
https://github.com/laravel/framework/commit/f336ba79e744257f84ebf0d096b0ebc62e8e1a4d
github.com
https://github.com/laravel/framework/pull/60151
github.com
https://github.com/laravel/framework/releases/tag/v12.60.0
github.com
https://github.com/laravel/framework/releases/tag/v13.10.0
github.com
https://github.com/laravel/framework/security/advisories/GHSA-5vg9-5847-vvmq
More from framework
9.8
CVE-2025-27515
Laravel is a web application framework
9.8
CVE-2021-43617
Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for…
9.2
CVE-2026-114509
Laravel TokenGuard authentication bypass through non-string API credentials
8.8
CVE-2020-19316
OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17
8.8
CVE-2018-6330
Laravel 5.4.15 is vulnerable to Error based SQL injection in save.php via dhx_user and dhx_version parameters