What is CVE-2026-48019?

CVE-2026-48019 is a high-severity vulnerability, classified under CRLF Injection. CVSS score: 8.9/10. Published 2026-09-04.

How severe is CVE-2026-48019?

High severity. CVSS v3 base score is 8.9 out of 10.

Is CVE-2026-48019 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

CVE-2026-48019

CVE-2026-48019

Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patched in versions 12.60.0 and 13.10.0.

Vulnerability class: CRLF Injection

CVSS v3 metric

CVSS v3 base score 8.9 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L.

Weakness classification (CWE)

CWE-93 — CRLF Injection

Public proof-of-concept exploits

derrickschoen/laravel-framework

References

Frequently asked questions

What is CVE-2026-48019?: CVE-2026-48019 is a high-severity vulnerability, classified under CRLF Injection. CVSS score: 8.9/10. Published 2026-09-04.
How severe is CVE-2026-48019?: High severity. CVSS v3 base score is 8.9 out of 10.
Is CVE-2026-48019 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.