CVE-2026-102279lowCWE-80

CVE-2026-102279: fallo de gravedad baja en laravel framework

Laravel: XSS in Debug Page Information

Publicada el · Actualizada el

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 3.1epss 0.2%
probabilidad de explotación
0.2%top 91% de las CVE
explotación observada
noninguna fuente lo reporta
Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is fixed in versions 12.69.0 and 13.30.0.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Productos afectados
laravel · framework
CVEs relacionadas — laravel framework

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-52301HIGHLaravel allows environment manipulation via query stringEPSS 44.8%CVE-2021-21263HIGHQuery Binding Exploitation in LaravelEPSS 1.6%CVE-2021-43808MEDIUMBlade `@parent` Exploitation Leading To Possible XSS in LaravelEPSS 0.8%CVE-2025-27515MEDIUMLaravel has a File Validation BypassEPSS 0.7%CVE-2026-48019HIGHCRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relayEPSS 0.5%
Referencias
https://github.com/laravel/framework/commit/b495ca2ec4e15a977e8700328bf13e8a79f29d12https://github.com/laravel/framework/pull/61381https://github.com/laravel/framework/releases/tag/v12.69.0https://github.com/laravel/framework/releases/tag/v13.30.0https://github.com/laravel/framework/security/advisories/GHSA-jh5r-qr3c-85q8