CVE-2026-49970
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
A path traversal vulnerability was discovered in the Laravel-Mediable library before version 7.0.0 in the File::sanitizePath() function. It allows attackers to write uploaded files to arbitrary locations by controlling the directory argument passed to MediaUploader::toDestination().
Risk Assessment
Attackers can exploit this vulnerability to place malicious files in sensitive locations such as the document root, environment configuration files, or application configuration directories, potentially leading to remote code execution and full server compromise.
Recommendation
Immediately upgrade the Laravel-Mediable library to version 7.0.0 or later, which includes a fix for the path traversal vulnerability.
Other vulnerabilities in Laravel-Mediable
See all- CVE-2026-49972High
A file upload vulnerability in Laravel-Mediable before version 7.0.0 allows unauthenticated attackers to achieve remote code execution by uploading a file with a double extension like shell.php.jpg. The PATHINFO_FILENAME extraction preserves the inner .php extension, and on misconfigured Apache or nginx servers, the file is executed as PHP while MIME and extension validation pass due to the outer .jpg.
- CVE-2026-49971Medium
Laravel-Mediable before version 7.0.0 contains a stored cross-site scripting vulnerability that allows authenticated or anonymous users to execute arbitrary JavaScript by uploading unsanitized SVG files containing embedded scripts in onload event handlers, script tags, or foreignObject elements.
- CVE-2026-49969High
Laravel-Mediable before version 7.0.0 contains a server-side request forgery (SSRF) vulnerability. It allows remote attackers to issue arbitrary HTTP requests from the server by supplying unvalidated caller-controlled URLs to endpoints backed by MediaUploader::fromSource().
Original NVD description (English source)
Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath() function that allows attackers to write uploaded files to arbitrary locations by controlling the directory argument passed to MediaUploader::toDestination(). Attackers can exploit the permissive character-class regex that allows both dot and slash characters combined with an ineffective trailing trim() call to bypass sanitization and upload files to sensitive locations such as the document root, environment configuration files, or application configuration directories, enabling remote code execution.