Vulnerability · Published Jul 14, 2025 · Assigned by GitHub_M
CVE-2025-53833LaRecipe is vulnerable to Server-Side Template Injection attacks
Critical 10.0
In plain English
A critical-severity security flaw in larecipe from saleem-hadad. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 9.1% (higher than 95% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection (SSTI), which could potentially lead to Remote Code Execution (RCE) in vulnerable configurations. Attackers could execute arbitrary commands on the server, access sensitive environment variables, and/or escalate access depending on server configuration. Users are strongly advised to upgrade to version v2.8.1 or later to receive a patch.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | binarytorch/larecipe | 2.8.1 | GHSA-jv7x-xhv2-p5v2 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| saleem-hadad | larecipe | < 2.8.1 |
Weakness: CWE-1336 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H