← All advisories

Critical severity9.8NVD Advisory· Published Apr 19, 2023· Updated Jun 17, 2026

CVE-2021-28254

CVE-2021-28254

Description

A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to execute arbitrary commands.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4

Laravel/Laravel3 versions
cpe:2.3:a:laravel:laravel:8.5.9:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:laravel:laravel:8.5.9:*:*:*:*:*:*:*
- (no CPE)
- (no CPE)range: <8.5.9
osv-coords
pkg:bitnami/laravel
Range: >= 8.5.9, < 8.5.10

Patches

Vulnerability mechanics

References

1

s1mple-top.github.io/2021/03/09/Laravel8-new-pop-chain-mining-process/nvdExploitThird Party Advisory

News mentions

0

No linked articles in our index yet.