CVE-2025-27515 is a critical (CVSS 9.8) validation bypass in the Laravel framework. When you validate a file or image field with a wildcard rule such as files.*, a crafted request could skip the rules. The fix is in Laravel 11.44.1 and 12.1.1, so upgrade and review how uploads are validated.
What's affected
The advisory and the record say the problem affects Laravel when wildcard validation is used on a file or image field (the files.* pattern). It is fixed in laravel/framework 11.44.1 and 12.1.1.
The record gives no earlier version boundary. Treat other releases before those two as suspect and check the GitHub security advisory GHSA-78fx-h6xr-vch4 for the exact range for your major version. The linked commit shows the code change.
Severity in the record: critical, CVSS 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Weakness classes: CWE-155 (Improper neutralization of wildcards or matching symbols).
How to check if you're exposed
If you use Composer, ask it which version you have:
composer show laravel/framework
composer why laravel/framework
Then search your code for validation rules that use a wildcard on a file or image field:
grep -rn "\.\*" app/Http app/Rules routes | grep -i -E "file|image|mimes"
Any match means your application uses the pattern the advisory describes. Run the free in-browser dependency scan at gold.safeguard.sh/scan on your composer.lock to see this CVE next to the rest of your dependencies.
What to do now
- Upgrade
laravel/frameworkto 11.44.1 or later on the 11.x line, or 12.1.1 or later on the 12.x line, withcomposer update laravel/framework. - Commit the updated
composer.lockand deploy through your normal pipeline. - Find every
files.*or similar wildcard rule on file and image fields and add a test that sends a file your rules should reject. - Do not rely on validation alone for uploads. Store them outside the web root, rename them, and never execute uploaded content.
- Check upload logs for unexpected file types or names since March 2025.
- Ask your dependency scanner to flag any other Laravel packages that pin an older framework version.
Why it matters
CWE-155 is improper neutralization of wildcards or matching symbols. The framework expands a wildcard rule over a list of inputs, and the advisory says a user-crafted request could slip past the rules that should have applied to each file. The weakness lives in how the rule is matched, not in your own code, which is why upgrading the framework is the fix.
The 9.8 score reflects an unauthenticated network attack with no user interaction and high impact on all three security properties. The real impact depends on what an application does with an uploaded file. If a bypass lets a file type through that your app later serves or processes, the result can be severe. If uploads are stored safely, it is far smaller. That is why reachability matters: an app that never uses wildcard file validation is not exposed through this path.
The record does not flag this CVE as known exploited (it is not on the CISA Known Exploited Vulnerabilities list as of the record), so treat it as a patching priority rather than an active incident, and keep watching the advisory.
Try it yourself
This demo shows how reachability analysis separates a vulnerable package that your code calls from one that only sits in your lockfile.
Click through it at your own pace, or open it full screen.
Quick check
Which Laravel versions fix CVE-2025-27515?
11.44.1 and 12.1.1, according to the record and the GitHub advisory. Check the advisory for your major version.
Am I exposed if I do not use wildcard file validation?
The advisory describes the wildcard pattern on file or image fields. If you never use it, this specific path does not apply, but upgrading is still sensible.
Sources
Last reviewed: 19 October 2026.
