Description

Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patched in versions 12.60.0 and 13.10.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.9",
  "pubDate": "2026-09-04T23:17:09.143Z",
  "pubdate": "2026-09-04T23:17:09.143Z",
  "executiveSummary": "A CRLF (Carriage Return Line Feed) injection vulnerability exists within the Laravel framework's email validation logic. This security flaw, affecting versions prior to 12.60.0 and 13.10.0, allows unauthenticated remote attackers to inject malicious header sequences into outbound email messages.\nThe vulnerability stems from improper sanitization of user-supplied input when processing email addresses, which interacts poorly with the underlying Symfony Mailer and Symfony Mime components. By successfully injecting CRLF sequences, an attacker can manipulate email headers, potentially leading to unauthorized BCC inclusions, message body injection, or the subversion of SMTP command sequences.\nThe risk is significant for applications that dynamically construct email recipients based on untrusted user input, as it exposes the infrastructure to potential email spoofing, spam distribution, or unauthorized communication leakage. Successful exploitation does not require prior authentication, as the attack vector relies on the application's process of handling outbound mail notifications to external addresses. Organizations are advised to upgrade to the patched versions immediately to remediate the sanitization deficiency.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient neutralization of control characters within the email validation process of the Laravel framework. Specifically, the framework fails to adequately sanitize input strings containing CRLF sequences (\\r\\n) before these strings are passed to the underlying Symfony Mailer and Symfony Mime libraries for email generation.\nIn the context of SMTP communication, headers are separated by CRLF sequences. When an application accepts user-supplied email addresses and incorporates them directly into the 'To', 'Cc', or 'Bcc' fields without strict validation, an attacker can provide a payload containing encoded or raw line break characters. When processed by Symfony Mailer, these injected sequences are interpreted as header terminators, allowing the attacker to prematurely terminate the current header and begin injecting arbitrary new headers.\nThe attack flow follows a predictable pattern: 1) The attacker identifies an application endpoint that triggers an outbound email, such as a contact form, password reset, or notification system that accepts a user-controlled email address. 2) The attacker submits a specially crafted email address containing injected CRLF sequences followed by additional header definitions, such as 'Bcc: victim@example.com' or 'X-Custom-Header: malicious-value'. 3) The application validates the input using the vulnerable Laravel component, which fails to strip the control characters. 4) The resulting input is passed to the mail transport layer. 5) Symfony Mailer renders the final MIME message with the injected headers intact. 6) The mail server processes the forged message, resulting in the unauthorized inclusion of BCC recipients or the manipulation of message routing and meta-data.\nThis vulnerability is particularly impactful because it allows for 'SMTP Header Injection.' An attacker can effectively hijack the structure of the email to bypass security controls, send messages to unauthorized recipients, or manipulate the perceived identity of the sender if 'From' headers are similarly manipulable within the application logic. Because the vulnerability exists at the framework's validation layer, it affects any application utilizing the standard Laravel mail notification flow with vulnerable versions. The lack of authentication requirements elevates the risk, as any visitor to the web application can potentially interact with the vulnerable input fields, leading to widespread exposure in production environments where mail services are exposed to the public internet."
}