CVE-2026-102279lowCWE-80

CVE-2026-102279: low-severity vulnerability in laravel framework

Laravel: XSS in Debug Page Information

Published · Updated

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.1epss 0.2%
exploitation probability
0.2%top 91% of all CVEs
observed exploitation
nono source reports it
Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected products
laravel · framework
Related CVEs — laravel framework

In the same product, most dangerous first.

CVE-2024-52301HIGHLaravel allows environment manipulation via query stringEPSS 44.8%CVE-2021-21263HIGHQuery Binding Exploitation in LaravelEPSS 1.6%CVE-2021-43808MEDIUMBlade `@parent` Exploitation Leading To Possible XSS in LaravelEPSS 0.8%CVE-2025-27515MEDIUMLaravel has a File Validation BypassEPSS 0.7%CVE-2026-48019HIGHCRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relayEPSS 0.5%
References
https://github.com/laravel/framework/commit/b495ca2ec4e15a977e8700328bf13e8a79f29d12https://github.com/laravel/framework/pull/61381https://github.com/laravel/framework/releases/tag/v12.69.0https://github.com/laravel/framework/releases/tag/v13.30.0https://github.com/laravel/framework/security/advisories/GHSA-jh5r-qr3c-85q8