CVE-2026-48019— CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay
Quick assessment
Affected
laravel framework
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Laravel 是一个 Web 应用框架。在 12.60.0 和 13.10.0 版本之前，Laravel 的电子邮件验证中存在 CRLF 注入漏洞。结合 Symfony Mailer 和 Symfony Mime 对某些字符序列的处理方式，该漏洞可能允许未认证的 attackers 干扰向用户提供的地址发送邮件的处理流程。该问题已在 12.60.0 和 13.10.0 版本中修复。
Possible ATT&CK Techniques 1 AI
T1565 · Data Manipulation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-48019
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay
Source: CVE Program / CVE List V5
Vulnerability Description
Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patched in versions 12.60.0 and 13.10.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
对CRLF序列的转义处理不恰当(CRLF注入)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-48019
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-48019
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-48019 (3)
Vendor Advisories for CVE-2026-48019 (1)
-
🔗 CRLF injection in default email rule · Advisory · laravel/framework · GitHub x_refsource_CONFIRM
Vendor Pages for CVE-2026-48019 (2)
-
🔗 Release v13.10.0 · laravel/framework · GitHub x_refsource_MISC
-
🔗 Release v12.60.0 · laravel/framework · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: framework
-
CVE-2026-78654
cleverbrush framework/deep deepExtend.ts deepExtend prototyp -
CVE-2026-73661
FreePBX: Authenticated Framework AUTHTYPE Can Be Restored Fr -
CVE-2026-41887
Flarum: Path traversal in LESS parser via theme color settin -
CVE-2025-67722
Authenticated amportal search for ‘freepbx_engine’ in non ro -
CVE-2025-66039
FreePBX Endpoint Manager Allows Unauthenticated Logins to Ad
Same vendor: laravel
-
CVE-2026-73683
Laravel Socialite Facebook Provider Authentication Bypass vi -
CVE-2026-39976
Laravel Passport's TokenGuard Authenticates Unrelated User f -
CVE-2026-23524
Laravel Redis Horizontal Scaling Insecure Deserialization -
CVE-2021-47756
Laravel Valet 2.0.3 - Local Privilege Escalation (macOS) -
CVE-2025-27515
Laravel has a File Validation Bypass
Same weakness: CWE-93
-
CVE-2026-75925
IXON VPN Client CRLF Injection -
CVE-2026-84962
Authenticated KMS request forgery via CRLF injection in GCP -
CVE-2026-84379
HTTPX2: Multipart part header injection via unvalidated file -
CVE-2026-84372
Predis: Redis command injection and denial of service via CR -
CVE-2026-82854
Nodemailer before 8.0.3 SMTP Command Injection via envelope.
V. Comments for CVE-2026-48019
No comments yet