{"action":"Upgrade laravel/framework to 12.61.1 or later.","affected":[{"fixed":"13.12.0","introduced":"13.0.0"},{"fixed":"12.61.1","introduced":"0"}],"component":"laravel/framework","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":["13.12.0","12.61.1"],"ghsa_id":"GHSA-crmm-hgp2-wgrp","id":"tcs_01M5KF16A34H6EZ8K7KMSC1EKQ","modified_at":"2026-09-10T03:51:08.672624600Z","published_at":"2026-06-17T13:54:13Z","references":["https://osv.dev/vulnerability/GHSA-crmm-hgp2-wgrp","https://github.com/laravel/framework/security/advisories/GHSA-crmm-hgp2-wgrp","https://github.com/laravel/framework/pull/60137","https://github.com/laravel/framework/pull/60230","https://github.com/laravel/framework/pull/60350","https://github.com/laravel/framework"],"severity":{"label":"medium","score":4.2},"sources":[{"source":"osv","source_id":"GHSA-crmm-hgp2-wgrp","url":"https://osv.dev/vulnerability/GHSA-crmm-hgp2-wgrp"}],"summary":"Laravel Framework: Temporary Signed URL Path Confusion"}