{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:84bc5905-168c-56ba-9c3c-e14f9460419b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "type": "library", "group": "laravel", "bom-ref": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare", "version": "5.8.38-p6+tuxcare", "pedigree": { "ancestors": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@5.8.38", "type": "library", "group": "laravel", "version": "5.8.38" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "AIKIDO-2026-10659", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } ], "bom-ref": "urn:uuid:65b4d6cf-fdb3-51ba-b420-9a078b183f90", "analysis": { "state": "resolved", "detail": "Vulnerability AIKIDO-2026-10659 is fixed in version 5.8.38-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2019-9081", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } ], "bom-ref": "urn:uuid:c8ead953-bb9b-594e-9ae1-122ab9a6a7f9", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.8.38-p6+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." } }, { "id": "CVE-2020-24941", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } ], "bom-ref": "urn:uuid:9e741dcf-7091-5dac-899d-3540ca188f08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-24941 is fixed in version 5.8.38-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2021-43617", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } ], "bom-ref": "urn:uuid:63e0a6b3-c508-5f79-bfe9-9399cdce2675", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.8.38-p6+tuxcare." } }, { "id": "CVE-2021-43808", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } ], "bom-ref": "urn:uuid:b15fa2b3-0e64-50c4-8e31-8795b0592c5e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-43808 is fixed in version 5.8.38-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2024-52301", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } ], "bom-ref": "urn:uuid:a4eff549-188d-5891-9a1e-94b2603bdba7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52301 is fixed in version 5.8.38-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2025-27515", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } ], "bom-ref": "urn:uuid:fd40bc94-ac15-5191-8bc4-d4e91ad2982c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27515 is fixed in version 5.8.38-p6+tuxcare of laravel/framework." } }, { "id": "CVE-2026-102279", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } ], "bom-ref": "urn:uuid:21ca0150-9cc6-5cbf-91e0-d94ef5ab4e73", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-102279 does not affect version 5.8.38-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-114509", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } ], "bom-ref": "urn:uuid:0ffd83c5-86cf-53ba-92fa-ac7ecbb204a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114509 affects version 5.8.38-p6+tuxcare of laravel/framework." } }, { "id": "GHSA-4mg9-vhxq-vm7j", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } ], "bom-ref": "urn:uuid:7e2063e6-37d4-517c-b33f-a69dddde215d", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.8.38-p6+tuxcare of laravel/framework." } }, { "id": "GHSA-5vg9-5847-vvmq", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } ], "bom-ref": "urn:uuid:29ca2a54-47b0-5ac1-9ea1-c871afec1228", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 5.8.38-p6+tuxcare of laravel/framework." } }, { "id": "GHSA-crmm-hgp2-wgrp", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } ], "bom-ref": "urn:uuid:efcfc81f-20df-5136-9ee0-850ffa83aa71", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.8.38-p6+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue.", "justification": "code_not_present" } }, { "id": "GHSA-qm5c-m76r-2hfr", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } ], "bom-ref": "urn:uuid:e19d7ef0-e81c-5bda-ba63-bb5307b61361", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.8.38-p6+tuxcare of laravel/framework." } }, { "id": "GHSA-x7p5-p2c9-phvg", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } ], "bom-ref": "urn:uuid:b1789012-90e1-5479-8f28-e2c94655a3b5", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.8.38-p6+tuxcare of laravel/framework." } } ], "dependencies": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p6+tuxcare" } ] }