GHSA-2ffv-r4r9-r8xr: Laravel RCE vulnerability in "cookie" session driver

critical Affects illuminate/cookie. Feed 2026.10.29.4, updated 2026-10-29; published 2024-05-15; advisory modified 2024-11-29.

Laravel RCE vulnerability in "cookie" session driver

Package: illuminate/cookie Composer
Affected versions: >=4.1.0 and <6.18.31 or >=7.0.0 and <7.22.4
Fixed in: 6.18.31, 7.22.4
Severity: critical
Exploitation: not on CISA KEV
Published: 2024-05-15
Source: osv.dev

References

CWE-94

NVD record illuminate/cookie advisories

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden deps composer.lock

# or, without Composer
pipx install phpwarden   &&   phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs How findings are ranked

Related advisories

2018-08-08-1 unknown Cookie serialization vulnerability same package: illuminate/cookie
2020-07-27-1 unknown RCE vulnerability in "cookie" session driver same package: illuminate/cookie
GHSA-2867-6rrm-38gr high Laravel Cookie serialization vulnerability same package: illuminate/cookie
CVE-2017-9841 KEV critical Code Injection in PHPUnit same weakness: CWE-94
CVE-2021-3129 KEV critical Unauthenticated remote code execution via insecure file handling in debug mode same weakness: CWE-94
CVE-2025-32432 KEV critical Craft CMS Allows Remote Code Execution same weakness: CWE-94