CVE-2021-47756: Laravel Valet Privilege Escalation Flaw

CVE-2021-47756 Overview

CVE-2021-47756 is a local privilege escalation vulnerability affecting Laravel Valet versions 1.1.4 through 2.0.3 on macOS. The flaw stems from incorrect permission assignment on the symlinked valet command, which can be modified by a low-privileged user yet executes with root privileges. An attacker with local access can replace or edit the symlinked command to run arbitrary code as root without additional authentication. The weakness is categorized under CWE-732: Incorrect Permission Assignment for Critical Resource.

Critical Impact
A local user can escalate to root by tampering with the valet symlink, gaining full control over the macOS host running Laravel Valet.

Affected Products

Laravel Valet 1.1.4 through 2.0.3
macOS systems running affected Valet versions
PHP development environments configured with vulnerable Valet installations

Discovery Timeline

2026-01-16 - CVE-2021-47756 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2021-47756

Vulnerability Analysis

Laravel Valet is a macOS development environment that installs a valet command via Composer and symlinks it into a system path. During installation, Valet configures sudo rules so the valet command can run with root privileges without a password prompt. The vulnerability arises because the symlinked file and its target retain permissions that allow a non-root user to modify the executable content.

An attacker who controls the user account where Valet is installed can edit the script the symlink points to, then invoke sudo valet to execute attacker-controlled code as root. The result is a direct path from a standard developer account to full administrative control of the workstation. This affects developer endpoints used to handle source code, credentials, and CI tokens.

Root Cause

The root cause is incorrect permission assignment on the valet command target file. The symlinked binary is writable by the installing user while the associated sudoers entry grants passwordless root execution. This combination breaks the trust boundary between user-owned files and privileged execution.

Attack Vector

Exploitation requires local access with the user account that installed Valet. The attacker overwrites or edits the script targeted by the valet symlink and then runs sudo valet or triggers any workflow that invokes it. Because no extra authentication is required, the escalation is immediate. Technical exploitation details are published in Exploit-DB #50591 and the VulnCheck Advisory for Laravel Valet.

Detection Methods for CVE-2021-47756

Indicators of Compromise

Unexpected modification timestamps on the valet symlink target inside the user's Composer vendor/laravel/valet directory.
Shell history entries showing sudo valet invocations immediately following edits to the Valet PHP source files.
New root-owned processes spawned from /usr/local/bin/valet that do not match legitimate Valet subcommands.

Detection Strategies

Audit file integrity on the valet script and its symlink target, alerting on writes by non-root users followed by privileged execution.
Monitor macOS Endpoint Security framework events for execve calls to valet running as UID 0 with parents owned by standard users.
Review sudoers and sudoers.d entries on developer workstations to identify passwordless rules referencing valet.

Monitoring Recommendations

Collect process telemetry from developer macOS endpoints and search for sudo valet executions paired with recent file modifications under ~/.composer or vendor/laravel/valet.
Track installation of Laravel Valet versions 1.1.4 through 2.0.3 across managed Macs using software inventory tools.
Alert on creation or modification of symlinks in /usr/local/bin that resolve into user-writable paths.

How to Mitigate CVE-2021-47756

Immediate Actions Required

Upgrade Laravel Valet to a version later than 2.0.3 on every macOS host where it is installed.
Inventory developer workstations to identify vulnerable installations and prioritize remediation on shared or multi-user systems.
Remove or tighten passwordless sudo rules for valet until patching is verified.

Patch Information

The Laravel Valet maintainers addressed the symlink permission issue in versions released after 2.0.3. Administrators should update via Composer using composer global update laravel/valet and confirm the installed version with valet --version. Refer to the Laravel Valet Documentation for current installation and upgrade guidance.

Workarounds

Restrict write permissions on the valet script target so only root can modify it, breaking the user-controlled write to privileged execute chain.
Remove the passwordless sudo entry for valet and require interactive authentication for any privileged Valet operations.
Uninstall Laravel Valet on hosts where it is not actively used for development work.

bash

# Configuration example: verify version and harden permissions
composer global show laravel/valet | grep versions
sudo chown root:wheel "$(readlink $(which valet))"
sudo chmod 755 "$(readlink $(which valet))"