CVE-2026-93352
CriticalCVSS 9.8Summary
Laravel-Mediable versions 7.0.0 to 7.0.2 contain an incomplete patch for CVE-2026-49972 — the .pht extension is missing from the forbidden_extensions blocklist in config/mediable.php. Apache on Debian and Ubuntu executes .pht files as PHP, allowing an attacker to upload a malicious file and achieve remote code execution.
Risk Assessment
An attacker can upload a .pht file that passes validation and is then executed as PHP, enabling remote code execution with the web server process privileges. This leads to full compromise of the application and potentially the server.
Recommendation
Update Laravel-Mediable to a version later than 7.0.2 that includes the fix. If updating is not possible, manually add 'pht' to the forbidden_extensions list in config/mediable.php.
Other vulnerabilities in Laravel-Mediable
See all- CVE-2026-49972High
A file upload vulnerability in Laravel-Mediable before version 7.0.0 allows unauthenticated attackers to achieve remote code execution by uploading a file with a double extension like shell.php.jpg. The PATHINFO_FILENAME extraction preserves the inner .php extension, and on misconfigured Apache or nginx servers, the file is executed as PHP while MIME and extension validation pass due to the outer .jpg.
- CVE-2026-49971Medium
Laravel-Mediable before version 7.0.0 contains a stored cross-site scripting vulnerability that allows authenticated or anonymous users to execute arbitrary JavaScript by uploading unsanitized SVG files containing embedded scripts in onload event handlers, script tags, or foreignObject elements.
- CVE-2026-49970High
A path traversal vulnerability was discovered in the Laravel-Mediable library before version 7.0.0 in the File::sanitizePath() function. It allows attackers to write uploaded files to arbitrary locations by controlling the directory argument passed to MediaUploader::toDestination().
- CVE-2026-49969High
Laravel-Mediable before version 7.0.0 contains a server-side request forgery (SSRF) vulnerability. It allows remote attackers to issue arbitrary HTTP requests from the server by supplying unvalidated caller-controlled URLs to endpoints backed by MediaUploader::fromSource().
Original NVD description (English source)
Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49972 in which the .pht extension is absent from the forbidden_extensions blocklist in config/mediable.php. The blocklist introduced to address CVE-2026-49972 includes phpt but omits pht, which Apache executes as PHP via the default FilesMatch directive on Debian and Ubuntu systems. An attacker can upload a .pht file that passes all validation in MediaUploader::verifyExtension() and File::sanitizeFileName() because pht is not present in the blocklist, causing the file to be written to disk and executed as PHP when requested, enabling remote code execution with the privileges of the web server process.