CVE-2024-0864: Laragon

Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days.

Enabling Simple Ajax Uploader plugin included in Laragon open-source software allows for a remote code execution (RCE) attack via an improper input validation in a file_upload.php file which serves as an example. By default, Laragon is not vulnerable until a user decides to use the aforementioned plugin.

Affected products

• Laragon Laragon: before 7.0.0 (fixed in 7.0.0)

Published 2024-02-29. Last modified 2026-06-17.