Loading CVE intelligence

CVE-2021-3129

CriticalPublished

Laravel Ignition File Upload Vulnerability

Published: Jan 12, 2021
Updated: Oct 21, 2025
Assigning CNA: mitre
Evidence observed: Jan 14, 2021

Primary CVSS

9.8/ 10Critical

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS probability estimate

99.9%

High · next 30 days

Percentile: 100.0%
Model date: Sep 21, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

CISA Known Exploited

This CVE appears in the CISA Known Exploited Vulnerabilities catalog.

Summary

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

Sources

33

CVE-2021-3129Exploit
CVE-2021-3129-Laravel Debug mode
CVE-2021-3129Exploit
Python exploit for CVE-2021-3129 that automates PHAR deserialization to execute arbitrary commands on vulnerable Laravel Ignition endpoints.
CVE-2021-3129-expExploit
Laravel Debug mode RCE漏洞（CVE-2021-3129）poc / exp
Mass-CVE-2021-3129-Scanner

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.

Scanner

Mass scanner for CVE-2021-3129 Laravel Debug RCE, automating detection across multiple hosts from a list.

CVE-2021-3129-ScriptExploit

Python exploit script for CVE-2021-3129, achieving remote code execution on Laravel debug mode with multiple RCE chains and reverse shell capability.

CVE-2021-3129Exploit

Python exploit script for Laravel Ignition CVE-2021-3129 RCE, using log poisoning and phar deserialization to execute commands on vulnerable web apps.

laravel-CVE-2021-3129-EXPExploit

One-click exploit for CVE-2021-3129 targeting Laravel applications. Executes remote code execution via crafted HTTP requests to achieve a shell.

CVE-2021-3129Exploit

Laravel RCE Exploit PoC - CVE-2021-3129 (user-friendly with automatic log path detection)

CVE-2021-3129PoC

Proof-of-concept exploit for CVE-2021-3129 targeting Laravel debug mode remote code execution vulnerability. Includes Docker-based test environment and Python exploit script.

CVE-2021-3130Exploit

Unauthenticated RCE in Laravel Debug Mode <8.4.2

CVE-2021-3129Exploit

Laravel RCE (CVE-2021-3129)

CVE-2021-3129_exploitExploit

Exploit for CVE-2021-3129

laravel-CVE-2021-3129-EXPExploit

One-click exploit for CVE-2021-3129 in Laravel, enabling remote code execution via crafted requests to achieve getshell.

CVE-2021-3129-LabExploit

CVE-2021-3129: Laravel Debug Mode RCE - Complete exploitation lab with Python exploit, Docker container, and security analysis guide.

CVE-2021-3129Exploit

Laravel <= v8.4.2 debug mode: Remote code execution (CVE-2021-3129)

laravel-exploitsExploit

Exploit for CVE-2021-3129

Laravel_CVE-2021-3129_EXPExploit

Exploit for CVE-2021-3129 targeting Laravel Ignition 2.5.1, leveraging phpggc for remote code execution via malicious log files.

Laravel-CVE-2021-3129Exploit

CVE-2021-3129 POC

CVE-2021-3129Exploit

CVE-2021-3129

CVE-2021-3129Exploit

A exploit script for CVE-2021-3129

Laravel-8.4.2-rce-CVE-2021-3129Exploit

Python exploit for CVE-2021-3129, a remote code execution vulnerability in Laravel 8.4.2. Includes Docker environment for local testing and requires phpggc for gadget chain generation.

CVE-2021-3129Exploit

Laravel debug mode - Remote Code Execution (RCE)

CVE-2021-3129PoC

Laravel RCE CVE-2021-3129

CVE-2021-3129---Laravel-RCEExploit

## About The script has been made for exploiting the Laravel RCE (CVE-2021-3129) vulnerability.<br> This script allows you to write/execute commands on a website running <b>Laravel <= v8.4.2</b>, that has "APP_DEBUG" set to "true" in its ".env" file.

Laravel-debug-CheckerScanner

CVE-2021-3129 Exploit Checker By ./MrMad

CVE-2021-3129-piperpwnExploit

Laravel Debug Mode and Payload

hoh4Exploit

Modified version of laravel ignition RCE (CVE-2021-3129) exploit script for Hour of Hack Session-4

CVE-2021-3129Exploit

Laravel debug rce

CVE-2021-3129Exploit

CVE-2021-3129 | Laravel Debug Mode Vulnerability

CVE-2021-3129Exploit

CVE-2021-3129-Laravel Debug mode 远程代码执行漏洞