Executive brief
Spatie Laravel Media Library is a popular tool used by developers to manage file uploads and media attachments in web applications. A security flaw allows attackers to force the web server to make unauthorized requests to other internal or external websites. This could lead to the exposure of sensitive internal data or allow the server to be used as a jumping-off point for further attacks on the company's private network.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Spatie Laravel Media Library before version 11.23.0. The vulnerability is located in the addMediaFromUrl() method within InteractsWithMedia.php, which fails to sufficiently validate user-supplied URLs. A remote attacker with low privileges can provide a malicious URL, causing the server to initiate arbitrary outbound HTTP requests. This can be used to probe internal network services, bypass firewalls, or access metadata services in cloud environments. The issue was addressed in version 11.23.0 by hardening filename validation and documenting SSRF boundaries.
Affected products
- Spatie laravel-medialibrary < 11.23.0
Timeline
- 2026-05-28: patched: Fix merged in pull request 3939
- 2026-05-29: advisory: GitHub Advisory published
- 2026-05-29: disclosed: NVD publication date
References
- https://github.com/spatie/laravel-medialibrary/pull/3939
- https://github.com/spatie/laravel-medialibrary/commit/608ea03703d3887c46434f5dda6af56de6346aba
- https://github.com/spatie/laravel-medialibrary/releases/tag/11.23.0
- https://www.vulncheck.com/advisories/spatie-laravel-media-library-ssrf-via-addmediafromurl