UpHeron
All vulnerabilities

Servers and applications

GHSA-v5ch-g375-82r6

Temporary signed URL expiration bypass

Severity
Medium 4.8
Published
11 Nov 2026
Last changed
11 Nov 2026
Added to UpHeron
11 Nov 2026
Fixed in
12.72.0, 13.41.0
Attack
Over the network · Only under certain conditions · No login needed · No user action needed
Attacker can
Read some data · Change some data
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Sources
Project advisories (GitHub)

Description

When PHP's max_input_vars limit causes the expires query parameter to be dropped from the parsed query, Laravel's signed URL validation can still verify the signature against the raw query string. signatureHasNotExpired() then treats the URL as non-expiring, so an expired temporary signed URL may be accepted. Exploitation requires a request line long enough to exceed max_input_vars, which depends on server and proxy limits.

From laravel/framework's security advisory.

Workarounds

  • Limit URL length at the web server. Default nginx and Apache settings already reject the long URL the attack needs.
  • If web server configuration is unavailable, add a middleware ahead of signed that returns an error when the raw query has more pairs than max_input_vars or when expires appears in the raw query but is missing from the parsed one.
Workarounds as given by laravel/framework's security advisory.

Affected software

SoftwareAffected versions
LaravelServers and applications · github:laravel/framework
  • Every version before 12.72.0
  • From 13.0.0 before 13.41.0

References