CVE-2025-27515 Proof of Concept

A practical demonstration of CVE-2025-27515, a file upload validation bypass vulnerability in Laravel Framework (≤ 12.0.0).

Vulnerability Overview

CVE-2025-27515 is a validation bypass that allows attackers to circumvent file upload restrictions when Laravel applications use wildcard validation patterns (files.*). The vulnerability enables uploading of malicious files by exploiting weaknesses in how Laravel processes array-based file uploads.

Severity: Medium/High
CWE: CWE-20 (Improper Input Validation)

Attack Vector

The exploit uses a polyglot JPEG+PHP file that:

• Contains valid JPEG magic bytes (FF D8 FF E0) to bypass MIME type validation
• Includes embedded PHP code (<?php system($_GET['cmd']); ?>)
• Uses .jpg extension to pass file extension checks

Quick Start

Run the Vulnerable Application