CVE-2021-3129 Known ransomware use

Laravel Ignition File Upload Vulnerability

Laravel — Ignition

Added to KEV catalog: 18 September 2023
Federal remediation due date: 9 October 2023

CISA Description

Laravel Ignition contains a file upload vulnerability that allows unauthenticated remote attackers to execute malicious code due to insecure usage of file_get_contents() and file_put_contents().

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://github.com/facade/ignition/releases/tag/2.5.2; https://nvd.nist.gov/vuln/detail/CVE-2021-3129

View on NVD View on MITRE CVE View full CISA catalog

More Laravel Vulnerabilities

CVE-2025-54068

Laravel Livewire Code Injection Vulnerability

CVE-2018-15133

Laravel Deserialization of Untrusted Data Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services