CVE-2024-52301: Laravel framework argument injection alters request environment

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityRemote, unauthenticated argument injection with high integrity impact and a high EPSS score, though no known exploitation or KEV listing.

What it is

Laravel mishandles the register_argc_argv PHP directive: when that directive is on, a crafted query string on any URL can inject argv values that change the environment the framework uses to handle the request. This matters because environment selection drives configuration and security-relevant behavior, and the flaw is remotely reachable without authentication. Fixed versions are 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23 and 11.31.0.

Impact

An attacker can force the application into an unintended environment, which can expose non-production configuration or weaken environment-dependent protections. The CVSS 4.0 vector shows high integrity impact with no confidentiality or availability impact.

Attack surface

Reached over the network by calling any URL with a specially crafted query string; no authentication or user interaction is required per the CVSS vector. It only applies where the PHP register_argc_argv directive is enabled.

Exploitation

Not listed in CISA KEV and no public exploit or ransomware use is recorded in the references. EPSS is high at roughly 0.448 (98.7th percentile), indicating elevated likelihood of attempted exploitation.

What to do

• Upgrade Laravel to 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, 11.31.0 or later; the fix ignores argv values for environment detection on non-CLI SAPIs.
• If immediate upgrade is not possible, set register_argc_argv=Off in PHP configuration for web SAPI processes.
• Apply the Debian security update for packaged Laravel where applicable.
• Audit application environment configuration so that a forced environment switch cannot expose debug mode, alternate credentials or relaxed security settings.

Detection

• Search web server and application logs for requests with unusual query strings containing argv-style or environment-like parameters.
• Monitor for unexpected changes in application environment or configuration behavior per request, such as debug output or non-production settings appearing in responses.
• Verify the register_argc_argv setting across PHP-FPM, Apache mod_php and other web SAPI deployments and alert on hosts where it is enabled.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.