CVE-2021-3129

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/162094/Ignition-2.5.1-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/165999/Ignition-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/facade/ignition/pull/334Patch, Third Party Advisory
https://www.ambionics.io/blog/laravel-debug-rceExploit, Third Party Advisory
http://packetstormsecurity.com/files/162094/Ignition-2.5.1-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/165999/Ignition-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/facade/ignition/pull/334Patch, Third Party Advisory
https://www.ambionics.io/blog/laravel-debug-rceExploit, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3129US Government Resource

Timeline

Published: Jan 12, 2021
Last modified: Jun 17, 2026
Added to CISA KEV: Sep 18, 2023
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-312927.5An integer overflow in CrwMap::encode0x1810 of Exiv2 0.27.3 allows attackers to trigger a heap-based buffer overflow and cause a denial of s CVE-2021-312945.9Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command (specificall CVE-2021-31305.9Within the Open-AudIT up to version 3.5.3 application, the web interface hides SSH secrets, Windows passwords, and SNMP strings from users u CVE-2021-31317.5The Web server in 1C:Enterprise 8 before 8.3.17.1851 sends base64 encoded credentials in the creds URL parameter.CVE-2021-313149.8File upload vulnerability in ejinshan v8+ terminal security system allows attackers to upload arbitrary files to arbitrary locations on the CVE-2021-313155.5Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the blit function of th CVE-2021-313169.8The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter.CVE-2021-313175.5Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the VDasher constructor of th CVE-2021-313185.5Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the LOTCompLayerItem::LOTComp CVE-2021-313195.5Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by an Integer Overflow in the LOTGradient::populate CVE-2021-313207.1Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the VGradientCache::gen CVE-2021-313217.1Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the gray_split_cubic fu