CVE Tools
Sign in

CVE-2021-3129

Published: Jan 12, 2021Updated: Nov 10, 2025 Sources: CVE List NVD GHSA BDUNVD-CWE-noinfo
9.8CRITICAL
NVD MITRE
EPSS Score
99.9%
Top 0.0%
CISA KEV
Active Exploitation
Since Sep 18, 2023
Exploits
4 Known
Remediation
Patch Available
Self-Check
Nuclei · OpenVAS

Description

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.

No summary for this CVE yet.

CVSS Vector Breakdown

AV:NAC:LPR:NUI:NS:UC:HI:HA:H
Exploitability
AV:NAttack Vector
Network
AC:LAttack Complexity
Low
PR:NPrivileges Required
None
UI:NUser Interaction
None
Scope
S:UScope
Unchanged
Impact
C:HConfidentiality
High
I:HIntegrity
High
A:HAvailability
High
Open in CVSS calculator →

Weaknesses

NVD-CWE-noinfo

Affected Products

Facade
commercialaka ignition
IgnitionOn-prem
ICS / OT / IoT / plc-scada-hmi
Packagist
package-ecosystem
facade/ignition
OSS Libraries
Taylor Otwell
individual-dev·AUaka laravel, laravel octane, laravel passport
LaravelLibrary
OSS Libraries / web-framework
and 2 more affected products View all →

Exploitability

CISA Known Exploited Vulnerability
Added to KEV:Sep 18, 2023
Remediation due:Oct 9, 2023
Ransomware:Known ransomware use

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

4 exploit sources identified

Exploit details including PoC links, Metasploit modules, and scanner templates are available after registration.

View exploit details
Official Patch Available
Is your org exposed to CVE-2021-3129?We'll check your whole external perimeter for exposure — free. Check my exposure

References

http://packetstormsecurity.com/files/162094/Ignition-2.5.1-Remote-Code-Execution.html
packetstormsecurity.com
http://packetstormsecurity.com/files/165999/Ignition-Remote-Code-Execution.html
packetstormsecurity.com
https://github.com/facade/ignition/pull/334
github.com
and 11 more references View all →

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2021-3129 and every CVE in our database. Create a free account — no credit card required.

Create Free Account
Plain-language analysis
Impact assessment and exploitation scenario in plain English
Attack graph visualization
Interactive attack path and kill chain mapping
Exploit details & PoC links
ExploitDB, Metasploit, GitHub PoCs with direct links
Nuclei scanner templates
Ready-to-use vulnerability scanner templates
Full remediation guide
Patch instructions, workarounds, and compliance impact
Interactive AI chat
Ask questions about this vulnerability in natural language
Related vulnerabilities
Semantically similar CVEs and attack patterns
REST API & MCP access
Integrate vulnerability data into your workflows