CVE-2026-49972
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
A file upload vulnerability in Laravel-Mediable before version 7.0.0 allows unauthenticated attackers to achieve remote code execution by uploading a file with a double extension like shell.php.jpg. The PATHINFO_FILENAME extraction preserves the inner .php extension, and on misconfigured Apache or nginx servers, the file is executed as PHP while MIME and extension validation pass due to the outer .jpg.
Risk Assessment
The risk for the organization includes full server compromise, potentially leading to data theft, malware installation, or further attacks on the infrastructure.
Recommendation
Immediately upgrade Laravel-Mediable to version 7.0.0 or later and configure the web server to prevent execution of files with double extensions as PHP.
Other vulnerabilities in Laravel-Mediable
See all- CVE-2026-49971Medium
Laravel-Mediable before version 7.0.0 contains a stored cross-site scripting vulnerability that allows authenticated or anonymous users to execute arbitrary JavaScript by uploading unsanitized SVG files containing embedded scripts in onload event handlers, script tags, or foreignObject elements.
- CVE-2026-49970High
A path traversal vulnerability was discovered in the Laravel-Mediable library before version 7.0.0 in the File::sanitizePath() function. It allows attackers to write uploaded files to arbitrary locations by controlling the directory argument passed to MediaUploader::toDestination().
- CVE-2026-49969High
Laravel-Mediable before version 7.0.0 contains a server-side request forgery (SSRF) vulnerability. It allows remote attackers to issue arbitrary HTTP requests from the server by supplying unvalidated caller-controlled URLs to endpoints backed by MediaUploader::fromSource().
Original NVD description (English source)
Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading a file with an embedded PHP extension disguised within a double extension such as shell.php.jpg. The PATHINFO_FILENAME extraction preserves the inner .php extension in the base name, and on misconfigured Apache or nginx servers that execute any filename containing .php as PHP, the stored file is interpreted as executable code while all MIME type, extension, and aggregate type validation checks pass due to the outer .jpg extension.