Laravel-Mediable vulnerabilities

Laravel-Mediable versions 7.0.0 to 7.0.2 contain an incomplete patch for CVE-2026-49972 — the .pht extension is missing from the forbidden_extensions blocklist in config/mediable.php. Apache on Debian and Ubuntu executes .pht files as PHP, allowing an attacker to upload a malicious file and achieve remote code execution.

A file upload vulnerability in Laravel-Mediable before version 7.0.0 allows unauthenticated attackers to achieve remote code execution by uploading a file with a double extension like shell.php.jpg. The PATHINFO_FILENAME extraction preserves the inner .php extension, and on misconfigured Apache or nginx servers, the file is executed as PHP while MIME and extension validation pass due to the outer .jpg.

Laravel-Mediable before version 7.0.0 contains a stored cross-site scripting vulnerability that allows authenticated or anonymous users to execute arbitrary JavaScript by uploading unsanitized SVG files containing embedded scripts in onload event handlers, script tags, or foreignObject elements.

A path traversal vulnerability was discovered in the Laravel-Mediable library before version 7.0.0 in the File::sanitizePath() function. It allows attackers to write uploaded files to arbitrary locations by controlling the directory argument passed to MediaUploader::toDestination().

Laravel-Mediable before version 7.0.0 contains a server-side request forgery (SSRF) vulnerability. It allows remote attackers to issue arbitrary HTTP requests from the server by supplying unvalidated caller-controlled URLs to endpoints backed by MediaUploader::fromSource().