CVE-2026-48555

HighCVSS 7.4

Published: 29/05/2026(UTC)Updated: 22/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

Spatie Laravel Media Library before version 11.23.0 contains a server-side request forgery (SSRF) vulnerability. A remote attacker can force the server to issue arbitrary outbound HTTP requests by passing user-controlled URLs to the addMediaFromUrl() method in InteractsWithMedia.php.

Risk Assessment

An attacker can use the server to scan internal networks, attack other systems, or steal sensitive data accessible from the server.

Recommendation

Update the Spatie Laravel Media Library to version 11.23.0 or later, which includes a fix that eliminates the SSRF vulnerability.

Other vulnerabilities in Spatie Laravel Media Library

CVE-2026-48557High
Spatie Laravel Media Library before version 11.23.0 has a file upload restriction bypass in FileAdder::defaultSanitizer(). The sanitizer checks only the final filename suffix, allowing double-extension filenames such as shell.php.jpg to bypass the blocklist, with pathinfo() preserving inner .php stems in saved filenames. The blocklist also omits executable extensions including .php6, .shtml, and .htaccess. The double-extension bypass requires a legacy Apache AddHandler configuration to achieve PHP execution; the incomplete blocklist bypass does not.

Original NVD description (English source)

Spatie Laravel Media Library before version 11.23.0 contains a server-side request forgery vulnerability that allows remote attackers to cause the server to issue arbitrary outbound HTTP requests by passing user-controlled URLs to the addMediaFromUrl() method in InteractsWithMedia.php.