Description
LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection (SSTI), which could potentially lead to Remote Code Execution (RCE) in vulnerable configurations. Attackers could execute arbitrary commands on the server, access sensitive environment variables, and/or escalate access depending on server configuration. Users are strongly advised to upgrade to version v2.8.1 or later to receive a patch.
Exploits (2)
github
WORKING POC
by exploitintel · pythonpoc
https://github.com/exploitintel/eip-pocs-and-cves/tree/main/CVE-2025-53833
Nuclei Templates (1)
LaRecipe < 2.8.1 Remote Code Execution via SSTI
CRITICALVERIFIEDby iamnoooob,pdresearch
FOFA:
body="/binarytorch/larecipe/"
Scores
CVSS v3
10.0
EPSS
0.2635
EPSS Percentile
96.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lab Environment
patched
vulnerable
docker pull ghcr.io/exploitintel/cve-2025-53833-vulnerable:latest
Exploitation Intel
VulnCheck KEV
2025-08-07
Classification
CWE
CWE-1336
Status
draft
Affected Products (1)
binarytorch/larecipe
< 2.8.1Packagist
Timeline
Published
Jul 14, 2025
Tracked Since
Feb 18, 2026