Side-Channel Information Disclosure in Maravel PHP Framework

CVE-2026-53933

What is CVE-2026-53933?

The Maravel PHP framework has been identified with a vulnerability that allows for side-channel information disclosure. Versions prior to 10.73.1 handle dynamic placeholders incorrectly when matched against static routes. This can be exploited by an attacker to intentionally invoke a 500 Internal Server Error by passing literal template syntax in endpoint requests. Such errors can help attackers map out internal route parameters and controller schemas, giving them insight into the application's structure. Users are advised to upgrade to version 10.73.1 and implement defensive measures to reject literal brace patterns at the router engine level.

References