Missing Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Missing Authorization in the process that retrieves S3 signature images. An attacker can access temporary signed S3 URLs for signature images by knowing the filename, allowi...

Laravel Framework: Temporary Signed URL Path Confusion

A vulnerability in Laravel's local filesystem driver allows temporary signed URLs to be parsed ambiguously, potentially misrouting requests and bypassing expiration enforcement. Under certain conditions, a generated temporary signed URL can be interpreted differently by the server than intended a...

Improper Encoding or Escaping of Output

Overview laravel/framework is a PHP framework for web artisans. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the parsing of temporary signed URLs by the local filesystem driver. An attacker can access unintended resources or bypass expiration...