Laravel Risk of mass-assignment vulnerabilities
Laravel 4.1.29 improves the column quoting for all database drivers. This protects your application from some mass assignment vulnerabilities when not using the fillable property on models. If you are using the fillable property on your models to protect against mass assignment, your application is not vulnerable. However, if you are using guarded and are passing a user controlled array into an "update" or "save" type function, you should upgrade to 4.1.29 immediately as your application may be at risk of mass assignment.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | illuminate/database | >= 4.0.0, < 4.1.29 | 4.1.29 |
References
- Weakness (CWE)
CWE-20- Platform
- Composer
- Package
illuminate/database- Disclosed
- 15.05.2024
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-cc2w-ghc5-m5qr - CC BY 4.0
Vulnerability history: illuminate/database
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 5
- First → latest
- 01.2021 05.2024
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 4
- Medium 1
Disclosures per year
- 2021: 3
- 2022: 1
- 2023: 0
- 2024: 1
- 2025: 0
- 2026: 0
-
Laravel Risk of mass-assignment vulnerabilities this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.