Vulnerability record · CVE-2021-3129 · published 12 January 2021
CVE-2021-3129: Laravel Ignition debug mode file handling remote code execution
Facade · Ignition
Ignition before 2.5.2, used by Laravel and other products, mishandles file_get_contents() and file_put_contents(), letting unauthenticated remote attackers execute arbitrary code. It matters because Laravel apps running debug mode before 8.4.2 are directly reachable and the flaw is actively exploited in the wild.
Description
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityUnauthenticated network RCE with a 9.8 CVSS score, KEV listing, ransomware association and near-maximum EPSS probability.
What it is
Ignition before 2.5.2, used by Laravel and other products, mishandles file_get_contents() and file_put_contents(), letting unauthenticated remote attackers execute arbitrary code. It matters because Laravel apps running debug mode before 8.4.2 are directly reachable and the flaw is actively exploited in the wild.
Impact
An attacker gains arbitrary code execution on the web server, typically leading to full application and host compromise. CISA lists known ransomware campaign use, so impact can extend to data encryption and extortion.
Attack surface
Reachable over the network with no authentication and no user interaction (CVSS AV:N/PR:N/UI:N). Exploitation requires the target to run a vulnerable Ignition version with Laravel debug mode enabled.
Exploitation
Listed in CISA KEV since 2023-09-18 with known ransomware campaign use, and EPSS 30-day probability is 0.99943 (99.97th percentile). Multiple public exploit references exist, including Packet Storm and Ambionics write-ups.
What to do
- Upgrade Ignition to 2.5.2 or later and Laravel to 8.4.2 or later.
- Disable debug mode (APP_DEBUG=false) in all production environments.
- Restrict or block external access to debug/error endpoints until patching completes.
- If patching is not possible, discontinue use of the affected product per CISA guidance.
- Verify no unauthorized file writes or web shells remain after remediation.
Detection
- Monitor web requests to Laravel debug/error routes for anomalous or encoded payloads.
- Alert on unexpected file creation or modification in application and storage directories.
- Hunt for outbound connections or child processes spawned by the PHP/web server process.
- Review logs for file_get_contents/file_put_contents abuse patterns tied to debug endpoints.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2021-3129 to the Known Exploited Vulnerabilities catalog on 18 September 2023 as "Laravel Ignition File Upload Vulnerability". CISA reports known use in ransomware campaigns. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 9 October 2023.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://packetstormsecurity.com/files/162094/Ignition-2.5.1-Remote-Code-Execution.html | ExploitThird Party AdvisoryVDB Entry |
| http://packetstormsecurity.com/files/165999/Ignition-Remote-Code-Execution.html | ExploitThird Party AdvisoryVDB Entry |
| https://github.com/facade/ignition/pull/334 | PatchThird Party Advisory |
| https://www.ambionics.io/blog/laravel-debug-rce | ExploitThird Party Advisory |
| http://packetstormsecurity.com/files/162094/Ignition-2.5.1-Remote-Code-Execution.html | ExploitThird Party AdvisoryVDB Entry |
| http://packetstormsecurity.com/files/165999/Ignition-Remote-Code-Execution.html | ExploitThird Party AdvisoryVDB Entry |
| https://github.com/facade/ignition/pull/334 | PatchThird Party Advisory |
| https://www.ambionics.io/blog/laravel-debug-rce | ExploitThird Party Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3129 | US Government Resource |
Track CVE-2021-3129 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-3129), CISA KEV, FIRST EPSS (scores of 2026-09-16). This page is refreshed as NVD updates the record.
