
I would not ship a file download until Laravel 13.30 — Storage::path() finally matches get()
On 13.29, Storage::get('../../../.env') already threw. Storage::path() of the same string still concatenated past the disk root. 13.30 runs path() through Flysystem's WhitespacePathNormalizer. I would bump composer show laravel/framework before I trust a query-string download again.
Sep 9, 2026 · 9 min read