CVE-2025-49132: Laravel Translation Loader Path Traversal Unvalidated Inputcve-2025-49132-laravel-translation-loader-path-traversal-unvalidated-input
Unvalidated HTTP request input flows through str_replace('.', '/') into a translation file loader (->load()). The dot-to-slash conversion transforms user-controlled dot-notation into filesystem path separators, creating a path-traversal primitive. When the loader resolves the constructed path and require()s the resulting PHP file, an attacker can achieve arb
