CVE-2021-3129: Laravel Ignition File Upload Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-09-18. EPSS: 99.9% chance of exploitation in the next 30 days.

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

Affected products

• Facade Ignition: before 2.5.2 (fixed in 2.5.2)

Published 2021-01-12. Last modified 2026-06-17.