GHSA-6rv8-qj5v-p8ch

When an application passes attacker-influenced, numeric-keyed parameters (for example a request's query array) to temporarySignedRoute() or signedRoute(), and those parameters do not fill a route placeholder, Laravel appended their values to the query string without URL encoding. An attacker can use this to add a second expires field to the signed URL. The signature covers that field, but request parsing reads it as the authoritative value, so the signed URL is treated as never expiring. Exploitation requires the application to forward such input into signed URL generation.