Is CVE-2026-48557 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48557 being exploited in the wild.

How severe is CVE-2026-48557?

High severity, with a CVSS score of 8.8, published 29 May 2026.

Which products and versions are affected?

spatie/laravel-medialibrary (Packagist) < 11.23.0, ECOSYSTEM:introduced=0,fixed=11.23.0; Spatie Laravel Media Library < 11.23.0.

Is there a fix for CVE-2026-48557?

Yes. spatie/laravel-medialibrary (Packagist): upgrade to 11.23.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48557 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-48557?

Check whether you run spatie/laravel-medialibrary (Packagist) or Spatie Laravel Media Library at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48557: Spatie Laravel Media Library file upload bypass in FileAdder

Q: Is there a fix for CVE-2026-48557?

Yes. spatie/laravel-medialibrary (Packagist): upgrade to 11.23.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-48557 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-48557?

Check whether you run spatie/laravel-medialibrary (Packagist) or Spatie Laravel Media Library at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48557 · Severity: high · CVSS 8.8 · Published 2026-05-29

Spatie Laravel Media Library is a popular tool for managing file uploads in Laravel applications. A security flaw in versions before 11.23.0 allows attackers to bypass file upload restrictions by using double file extensions (like "file.php.jpg") or less common executable extensions. This could allow an attacker to upload and execute malicious scripts on the server, potentially leading to a full system takeover or data theft.

Vendors: Packagist, Spatie.

Quick answers

Is CVE-2026-48557 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48557 being exploited in the wild.
How severe is CVE-2026-48557?: High severity, with a CVSS score of 8.8, published 29 May 2026.
Which products and versions are affected?: spatie/laravel-medialibrary (Packagist) < 11.23.0, ECOSYSTEM:introduced=0,fixed=11.23.0; Spatie Laravel Media Library < 11.23.0.
Is there a fix for CVE-2026-48557?: Yes. spatie/laravel-medialibrary (Packagist): upgrade to 11.23.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48557 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-48557?: Check whether you run spatie/laravel-medialibrary (Packagist) or Spatie Laravel Media Library at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

spatie/laravel-medialibrary (Packagist): upgrade to 11.23.0 or later
```
composer require spatie/laravel-medialibrary:^11.23.0
```

Technical details

A vulnerability exists in FileAdder::defaultSanitizer() where the validation logic only inspected the final suffix of a filename. This allowed attackers to bypass the blocklist using double extensions (e.g., shell.php.jpg), which could be executed as PHP in certain server environments (like legacy Apache AddHandler configurations). Additionally, the default blocklist was incomplete, missing executable extensions such as .php6, .shtml, and .htaccess. An attacker with upload privileges can exploit this to place malicious files on the server. The issue is fixed in version 11.23.0 by implementing per-segment extension checks and expanding the default disallowed list.

Affected products

Spatie laravel-medialibrary < 11.23.0

Identifiers

CVE-2026-48557
GHSA-3ggm-c5m7-hfv5

Timeline

2026-05-28: patched: Fix merged in pull request #3939
2026-05-29: disclosed: Initial advisory publication
2026-07-02: advisory: Last updated on GitHub Advisory Database

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.