CVE-2021-3129 Details
Description
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.
A remote code execution vulnerability exists in Ignition versions prior to 2.5.2, which is used in Laravel and other products. This vulnerability allows unauthenticated remote attackers to execute arbitrary code due to the insecure handling of file_get_contents() and file_put_contents(). It is exploitable on Laravel versions prior to 8.4.2 when the application is in debug mode.
Users can update to Ignition version 2.5.2 or later, and ensure that their Laravel application is not running in debug mode. Instructions for updating Ignition can be found in the Laravel documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 4, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3129 | CISA-ADP | US Government Resource |
| http://packetstormsecurity.com/files/162094/Ignition-2.5.1-Remote-Code-Execution.html | CVE | ExploitThird Party AdvisoryVDB Entry |
| http://packetstormsecurity.com/files/165999/Ignition-Remote-Code-Execution.html | CVE | ExploitThird Party AdvisoryVDB Entry |
| https://github.com/facade/ignition/pull/334 | CVE | PatchThird Party Advisory |
| https://www.ambionics.io/blog/laravel-debug-rce | CVE | ExploitThird Party Advisory |
| http://packetstormsecurity.com/files/162094/Ignition-2.5.1-Remote-Code-Execution.html | [email protected] | ExploitThird Party AdvisoryVDB Entry |
| http://packetstormsecurity.com/files/165999/Ignition-Remote-Code-Execution.html | [email protected] | ExploitThird Party AdvisoryVDB Entry |
| https://github.com/facade/ignition/pull/334 | [email protected] | PatchThird Party Advisory |
| https://www.ambionics.io/blog/laravel-debug-rce | [email protected] | ExploitThird Party Advisory |
This CVE is in CISA's Known Exploited Vulnerabilities Catalog
Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.
| Vulnerability Name | Date Added | Due Date | Required Action |
|---|---|---|---|
| Laravel Ignition File Upload Vulnerability | Sep 18, 2023 | Oct 9, 2023 | Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| facade ignition | < 2.5.2 |
CPE
Remediation
| |
| laravel laravel | < 8.4.2 |
CPE
Remediation
| |
Change History
15 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 10, 2025 | Modified Analysis | [email protected] |
| Oct 22, 2025 | CVE Modified | CISA-ADP |
| Oct 21, 2025 | CVE Modified | CISA-ADP |
| Oct 21, 2025 | CVE Modified | CISA-ADP |
| Mar 7, 2025 | Modified Analysis | [email protected] |
| Feb 4, 2025 | CVE Modified | CISA-ADP |
| Nov 21, 2024 | CVE Modified | CVE |
| May 14, 2024 | CVE Modified | [email protected] |
| Feb 22, 2022 | Modified Analysis | [email protected] |
| Feb 16, 2022 | CVE Modified | [email protected] |
| Apr 6, 2021 | CVE Modified | [email protected] |
| Feb 12, 2021 | CPE Deprecation Remap | [email protected] |
| Jan 20, 2021 | Initial Analysis | [email protected] |