CVE-2025-49132: Laravel Translation Loader Path Traversal Unvalidated Input
Unvalidated HTTP request input flows through str_replace('.', '/') into a translation file loader (->load()). The dot-to-slash conversion transforms user-controlled dot-notation into filesystem path separators, creating a path-traversal primitive. When the loader resolves the constructed path and require()s the resulting PHP file, an attacker can achieve arb
PHPgreprules fetch cve-2025-49132-laravel-translation-loader-path-traversal-unvalidated-input --engine opengrepDescription
Unvalidated HTTP request input flows through str_replace('.', '/') into a translation file loader (->load()). The dot-to-slash conversion transforms user-controlled dot-notation into filesystem path separators, creating a path-traversal primitive. When the loader resolves the constructed path and require()s the resulting PHP file, an attacker can achieve arb
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.