Laravel’s default email validation permits CRLF injection when combined with the parsing behavior of Symfony Mailer and Symfony Mime. An attacker who submits an email address to any endpoint that accepts user‑supplied email can inject arbitrary CRLF sequences, causing new headers or message boundaries in the outgoing e‑mail. The result is a forged or spoofed message that appears to originate from the application, enabling phishing, spam, or other malicious activities. This vulnerability is an input‑validation weakness, classified as CWE‑93.

All installations of the Laravel framework before v12.60.0 or v13.10.0 are vulnerable. Any web application that uses Laravel’s built‑in email validation and sends outbound mail to addresses supplied by users is at risk. Versions 12.60.0 and newer of Laravel, and 13.10.0 and newer, contain the correction.

The flaw carries a CVSS score of 8.9, indicating substantial risk. The EPSS score is not available, and the vulnerability is currently not listed in CISA’s KEV catalog, suggesting no confirmed exploitation yet. An unauthenticated attacker can exploit the flaw remotely via any HTTP interface that accepts an email address, without requiring authentication or additional privileges. The attack requires only sending a crafted request, making it both easy to deploy and potentially weaponized against vulnerable applications.