Executive brief
A security vulnerability in the Laravel-Mediable library allows attackers to upload malicious files to a web server. This library is used by developers to manage file uploads and attachments in Laravel applications. By disguising executable code as a harmless image, an attacker could potentially take full control of the server, leading to data theft or service disruption.
Technical details
A vulnerability classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) exists in plank/laravel-mediable through version 6.4.0. The issue arises when an application is configured to trust or prefer client-supplied MIME types during file upload handling. A remote, unauthenticated attacker can exploit this by submitting a file containing PHP code while declaring a benign MIME type (such as image/jpeg). If the application stores these files in a web-accessible directory without proper server-side validation or execution prevention, the attacker can achieve remote code execution (RCE). As of the advisory date, no patch is available.
Affected products
- Plank laravel-mediable Through 6.4.0
Timeline
- 2026-03-26: advisory: NVD publication date
- 2026-03-26: disclosed: Vulnerability reported by TuranSec