CVE-2026-48019

CVE-2026-48019 is a CRLF injection flaw (CWE-93) in Laravel's email validation that, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, affects Laravel versions prior to 12.60.0 and 13.10.0. An unauthenticated attacker can trigger it by supplying a crafted email address — for example via registration, password-reset, or contact forms — that passes Laravel's validation but is interpreted by the mail components in a way that interferes with outbound email processing. The attacker gains the ability to disrupt or manipulate mail sent to user-supplied addresses; the CVSS scope-change rating indicates potential for high confidentiality and integrity impact with some availability impact on other components, though the attack carries high complexity and no public PoC documents the full chain. Affected are applications built on Laravel 12.x before 12.60.0 or 13.x before 13.10.0 that send mail to user-supplied addresses using Symfony Mailer. No public proof of concept, no CISA KEV listing, and an EPSS of 0.7% indicate no known exploitation in the wild at this time.

What to do: Upgrade Laravel to version 12.60.0 or later on the 12.x branch, or 13.10.0 or later on the 13.x branch. As an interim mitigation, strip or reject CR/LF and other control characters in user-supplied email addresses before passing them to the mailer, and audit application code paths that feed user input into email sends. Given the high attack complexity, no public PoC, and no known in-the-wild exploitation, patching within normal maintenance cycles is reasonable rather than emergency response.