CVE-2025-53833
LaRecipe is vulnerable to Server-Side Template Injection attacks
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
LaRecipe is vulnerable to Server-Side Template Injection attacks
LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection (SSTI), which could potentially lead to Remote Code Execution (RCE) in vulnerable configurations. Attackers could execute arbitrary commands on the server, access sensitive environment variables, and/or escalate access depending on server configuration. Users are strongly advised to upgrade to version v2.8.1 or later to receive a patch.
Reserved 2025-07-09 | Published 2025-07-14 | Updated 2025-07-14 | Assigner GitHub_MCWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
github.com/...recipe/security/advisories/GHSA-jv7x-xhv2-p5v2
github.com/saleem-hadad/larecipe/pull/390
github.com/...ommit/c1d0d56889655ce5f2645db5acf0e78d5fc3b36b
Support options
