PT-2025-27543 · Laravel · Laravel

Cfreal · Published 2025-07-01 · Updated 2025-07-01 · CVE-2025-34060

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions: Monero Project's Laravel-based forum software (affected versions not specified)

Description: A PHP objection injection vulnerability exists in the Monero Project’s Laravel-based forum software due to unsafe handling of untrusted input in the "/get/image/" endpoint. The application passes a user-supplied link parameter directly to file get contents() without validation. MIME type checks using PHP’s finfo can be bypassed via crafted stream filter chains that prepend spoofed headers, allowing access to internal Laravel configuration files. An attacker can extract the APP KEY from config/app.php, forge encrypted cookies, and trigger unsafe unserialize() calls, leading to reliable remote code execution.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

RCE

Weakness Enumeration

CWE-502

CWE-20

CWE-829

Related Identifiers

CVE-2025-34060

Affected Products

Laravel

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-34060 · Security Note
• https://twitter.com/VulmonFeeds/status/1940122728247239059 · Twitter Post
• https://swap.gs/posts/monero-forums · Note
• https://twitter.com/CveFindCom/status/1940065490329649373 · Twitter Post
• https://vulncheck.com/advisories/monero-forum-rce · Note
• https://twitter.com/CVEnew/status/1940067213924290763 · Twitter Post