ZeroDay Findings
Sign inSign up

Findings

CVE-2021-3129

Laravel Ignition File Upload Vulnerability

Published Jan 12, 2021 · updated Jun 16, 2026 · facade ignition

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

Timeline

Detection, updates, and resolution for this record.

  1. Jan 12, 2021 · Catalog

    Detected

    Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

  2. Sep 18, 2023 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Oct 9, 2023 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Jun 16, 2026 · Catalog

    Updated

    Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date Oct 9, 2023

Affected

  • cpe facade/ignitionversion unspecified
  • vendor Laravel Ignitionversion unspecified

Sources

  • CISA KEVCVE-2021-3129

    Laravel Ignition contains a file upload vulnerability that allows unauthenticated remote attackers to execute malicious code due to insecure usage of file_get_contents() and file_put_contents().

    cisa.gov
  • CVE.orgCVE-2021-3129

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2021-3129

    30-day exploitation probability 99.9%

    first.org
  • Exploit Database49424

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesexploit_multi/php/ignition_laravel_debug_rce

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2021-3129

    Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/162094/Ignition-2.5.1-Remote-Code-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com
  • Packet Storm Securityhttp://packetstormsecurity.com/files/165999/Ignition-Remote-Code-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References