Junglewise Threat Intelligence

CVE-2026-4809: Plank laravel-mediable arbitrary file upload in file handling

CVE-2026-4809 · Severity: critical · CVSS 9.8 · Published 2026-03-26

Technologies: Plank Laravel-Mediable, Plank Mediable. Vendors: Plank.

Executive brief

A security vulnerability in the Laravel-Mediable library allows attackers to upload malicious files to a web server. This library is used by developers to manage file uploads and attachments in Laravel applications. By disguising executable code as a harmless image, an attacker could potentially take full control of the server, leading to data theft or service disruption.

Technical details

A vulnerability classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) exists in plank/laravel-mediable through version 6.4.0. The issue arises when an application is configured to trust or prefer client-supplied MIME types during file upload handling. A remote, unauthenticated attacker can exploit this by submitting a file containing PHP code while declaring a benign MIME type (such as image/jpeg). If the application stores these files in a web-accessible directory without proper server-side validation or execution prevention, the attacker can achieve remote code execution (RCE). As of the advisory date, no patch is available.

Affected products

  • Plank laravel-mediable Through 6.4.0

Timeline

  • 2026-03-26: advisory: NVD publication date
  • 2026-03-26: disclosed: Vulnerability reported by TuranSec

References

Related threats