CVE-2021-3129: Facade/ignition Remote Code Execution Vulnerability
CRITICALCVE-2021-3129 is a CRITICAL (CVSS 9.8) remote code execution vulnerability (CWE-94: Improper Control of Generation of Code ('Code Injection')) affecting Facade/ignition libraries in the Packagist ecosystem. The issue involves unauthenticated remote code execution in ignition. Remediation is available by upgrading affected packages to version 2.5.2, 2.4.2, 1.16.14, 1.6.15.
CVE-2021-3129 at a Glance
Security Impact
CVSS: 9.8
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H).
How to Fix CVE-2021-3129
To remediate this vulnerability, upgrade all affected Facade/ignition dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade facade/ignition to 2.5.2Upgrade facade/ignition to 2.4.2Upgrade facade/ignition to 1.16.14Upgrade facade/ignition to 1.6.15Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for facade/ignitionHow to Check if You Are Affected
To determine whether your application is affected by CVE-2021-3129, inspect your project dependencies for Facade/ignition:
inspect dependencies for facade/ignitionAnalyze the terminal output to locate any version of Facade/ignition in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.5.2), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-94: Improper Control of Generation of Code ('Code Injection'), where the product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. In Facade/ignition, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2021-3129 Affected Facade/ignition Versions
4 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
facade/ignition
|
Packagist |
≥ 2.5.0
< 2.5.2
|
2.5.2
|
|
facade/ignition
|
Packagist |
≥ 2.0.0
< 2.4.2
|
2.4.2
|
|
facade/ignition
|
Packagist |
≥ 1.7.0
< 1.16.14
|
1.16.14
|
|
facade/ignition
|
Packagist |
< 1.6.15
|
1.6.15
|
References
Frequently Asked Questions
What is CVE-2021-3129?
Which Facade/ignition versions are affected?
What version fixes CVE-2021-3129?
Is facade/ignition affected?
What is the CVSS score of CVE-2021-3129?
What CWE is associated with CVE-2021-3129?
How can I check Packagist dependencies for CVE-2021-3129?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-4qwp-7c67-jmcc",
"modified" : "2025-10-22T17:58:58Z",
"published" : "2021-03-29T20:23:46Z",
"aliases" : [ "CVE-2021-3129" ],
"summary" : "Unauthenticated remote code execution in Ignition",
"details" : "Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Packagist",
"name" : "facade/ignition"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.5.0"
}, {
"fixed" : "2.5.2"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Packagist",
"name" : "facade/ignition"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.0.0"
}, {
"fixed" : "2.4.2"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Packagist",
"name" : "facade/ignition"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.7.0"
}, {
"fixed" : "1.16.14"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Packagist",
"name" : "facade/ignition"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.6.15"
} ]
} ]
} ],
"references" : [ {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2021-3129"
}, {
"type" : "WEB",
"url" : "https://github.com/facade/ignition/pull/334"
}, {
"type" : "WEB",
"url" : "https://github.com/facade/ignition/commit/11ffca14abd22db779d90b12e193f8000f6d184b"
}, {
"type" : "WEB",
"url" : "https://github.com/FriendsOfPHP/security-advisories/blob/master/facade/ignition/CVE-2021-3129.yaml"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/facade/ignition"
}, {
"type" : "WEB",
"url" : "https://www.ambionics.io/blog/laravel-debug-rce"
}, {
"type" : "WEB",
"url" : "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3129"
}, {
"type" : "WEB",
"url" : "http://packetstormsecurity.com/files/162094/Ignition-2.5.1-Remote-Code-Execution.html"
}, {
"type" : "WEB",
"url" : "http://packetstormsecurity.com/files/165999/Ignition-Remote-Code-Execution.html"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-94" ],
"severity" : "CRITICAL",
"github_reviewed" : true,
"github_reviewed_at" : "2021-03-23T00:13:45Z",
"nvd_published_at" : "2021-01-12T15:15:00Z"
}
}