Laravel wildcard file validation bypass

This repository is a practical proof-of-concept for CVE-2025-27515, a file upload validation bypass vulnerability in Laravel Framework (<= 12.0.0). The repository contains a full Laravel application with a vulnerable file upload endpoint (app/Http/Controllers/UploadController.php) that uses wildcard validation ('files.*'), allowing attackers to upload files that bypass intended restrictions. The exploit (exploit.py) is a Python script that crafts and uploads a polyglot JPEG+PHP file, which passes validation and is stored in a web-accessible directory. The payload is a simple PHP web shell that enables remote code execution via HTTP requests. The repository includes all necessary files to run the vulnerable application and demonstrates the attack end-to-end. The main attack vector is network-based, targeting the /upload HTTP endpoint, and the exploit is operational, providing a working RCE payload. No evidence of fake or detection-only code is present; this is a real exploit for educational and authorized testing purposes.

This repository is a comprehensive proof-of-concept (PoC) for CVE-2025-27515, a file upload validation bypass in Laravel Framework (≤ 12.0.0) when using wildcard validation (e.g., 'files.*'). The repository contains a full Laravel application intentionally configured to be vulnerable, as well as two exploit scripts: one in Python (exploit.py) and one in Rust (exploit-rs/src/main.rs). The exploit works by crafting a polyglot file that is both a valid JPEG and a PHP webshell, bypassing MIME type and extension checks. The exploit scripts automate the process of obtaining a CSRF token, uploading the malicious file to the /upload endpoint, and reporting the result. The vulnerable code is in app/Http/Controllers/UploadController.php, which uses insufficient validation on file uploads. The repository is structured as a typical Laravel project, with additional exploit scripts and clear documentation in the README.md. The main attack vector is network-based, targeting the /upload HTTP endpoint. The exploit provides a working webshell if successful, allowing remote command execution via the uploaded file.