CVE-2018-15133: Laravel Deserialization of Untrusted Data Vulnerability
Summary: CVE-2018-15133 is a deserialization of untrusted data vulnerability in the Laravel Framework that allows remote command execution. Exploitation requires that a malicious user has already accessed the application encryption key, the APP_KEY environment variable.
Why it matters: The exploit path runs through one environment variable: anyone who reaches your APP_KEY can turn this into remote command execution, and CISA set a remediation due date of 2024-02-06.
Read the original at CISA KEV Catalog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2018-15133Laravel
- Related
- CVE-2025-54068: Laravel Livewire Code Injection Vulnerability Known Exploited Vulnerabilities · Mar 20, 2026CVE-2021-3129: Laravel Ignition File Upload Vulnerability Known Exploited Vulnerabilities · Sep 18, 2023Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026