CVE-2026-4809
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk67th percentile - higher than 67% of all known CVEs
Summary
The plank/laravel-mediable library up to version 6.4.0 allows upload of dangerous file types when the application accepts or prefers a client-supplied MIME type. A remote attacker can submit a file with executable PHP code while declaring a benign image MIME type, resulting in arbitrary file upload.
Risk Assessment
Risk of arbitrary code execution on the server, potentially leading to full compromise of the application and server, and data breach.
Recommendation
Update the library to a patched version. Additionally, enforce server-side file type validation regardless of the declared MIME type.
Original NVD description (English source)
plank/laravel-mediable through version 6.4.0 can allow upload of a dangerous file type when an application using the package accepts or prefers a client-supplied MIME type during file upload handling. In that configuration, a remote attacker can submit a file containing executable PHP code while declaring a benign image MIME type, resulting in arbitrary file upload.