# CVE-2025-53833: LaRecipe - RCE

> Live exploitation tracking for CVE-2025-53833 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-53833

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 10.0
- **Public exploit available:** Yes
- **Affected products:** Saleem Hadad LaRecipe
- **Weaknesses:** CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine)
- **Tags:** web_application

## Description

LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection (SSTI), which could potentially lead to Remote Code Execution (RCE) in vulnerable configurations. Attackers could execute arbitrary commands on the server, access sensitive environment variables, and/or escalate access depending on server configuration. Users are strongly advised to upgrade to version v2.8.1 or later to receive a patch.

## CrowdSec analysis

[CVE-2025-53833](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-53833) is a critical Server-Side Template Injection (SSTI) vulnerability in LaRecipe versions prior to 2.8.1, which can lead to remote code execution (RCE) under certain configurations. Exploiting this flaw, attackers may execute arbitrary commands on the server, access sensitive environment variables, and potentially escalate their privileges, posing a severe risk to affected Laravel applications.

CrowdSec has been tracking this vulnerability and its exploits since 24th of July 2025.

CrowdSec network observations suggest that most exploitation of CVE-2025-53833 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
In addition, according to the CrowdSec network, attack volume against CVE-2025-53833 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit the LaRecipe documentation endpoint by injecting SSTI payloads such as `{{phpinfo()}}` in the query string, potentially leading to remote code execution on vulnerable servers.

## Timeline

- 2025-07-14: CVE Published. CVE-2025-53833 is published to NVD.
- 2025-07-24: Rule Released. CrowdSec releases a rule to detect CVE-2025-53833 exploitation attempts against the CrowdSec Network.
- 2025-08-07: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-53833 for the first time.

## References

- https://github.com/saleem-hadad/larecipe/security/advisories/GHSA-jv7x-xhv2-p5v2
- https://github.com/saleem-hadad/larecipe/commit/c1d0d56889655ce5f2645db5acf0e78d5fc3b36b
- https://github.com/saleem-hadad/larecipe/pull/390
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-53833.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-53833) follows observed exploitation activity for CVE-2025-53833. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.