Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
The macropay-solutions/laravel-crud-wizard-free Packagist package is vulnerable in versions before 3.4.17, and the source describes a file validation bypass. The source gives few details about how the bypass works or what an attacker needs to exploit it, and it does not say what access is required. The fix is to upgrade to version 3.4.17, which the source says addresses illuminate/validation versions 8.0.0 through 11.44.0; the source also gives a workaround for those using illuminate/validation below 11.44.1.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| Not published | None | 4.0 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | GitHub Advisory Database |
- CISA KEV Not listed.
- EPSS No score.
Timeline
- 31 Oct 2026, 13:59 UTC First seen by agentprime
- 31 Oct 2026, 13:59 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-3wgq-h4fr-cwg5
- OSV: GHSA-3wgq-h4fr-cwg5
- github.com/laravel/framework/security/advisories/GHSA-78fx-h6xr-vch4
- github.com/macropay-solutions/laravel-crud-wizard-free/security/advisories/GHSA-3wgq-h4fr-cwg5
- nvd.nist.gov/vuln/detail/CVE-2025-27515
- github.com/macropay-solutions/laravel-crud-wizard-free/commit/5c268cc930ec23a2e6761878cc57c6bd1d1889d2
- github.com/macropay-solutions/laravel-crud-wizard-free