Executive brief
Spatie Laravel Media Library is a popular tool for managing file uploads in Laravel applications. A security flaw in versions before 11.23.0 allows attackers to bypass file upload restrictions by using double file extensions (like "file.php.jpg") or less common executable extensions. This could allow an attacker to upload and execute malicious scripts on the server, potentially leading to a full system takeover or data theft.
Technical details
A vulnerability exists in FileAdder::defaultSanitizer() where the validation logic only inspected the final suffix of a filename. This allowed attackers to bypass the blocklist using double extensions (e.g., shell.php.jpg), which could be executed as PHP in certain server environments (like legacy Apache AddHandler configurations). Additionally, the default blocklist was incomplete, missing executable extensions such as .php6, .shtml, and .htaccess. An attacker with upload privileges can exploit this to place malicious files on the server. The issue is fixed in version 11.23.0 by implementing per-segment extension checks and expanding the default disallowed list.
Affected products
- Spatie laravel-medialibrary < 11.23.0
Timeline
- 2026-05-28: patched: Fix merged in pull request #3939
- 2026-05-29: disclosed: Initial advisory publication
- 2026-07-02: advisory: Last updated on GitHub Advisory Database
References
- https://github.com/spatie/laravel-medialibrary/pull/3939
- https://github.com/spatie/laravel-medialibrary/commit/608ea03703d3887c46434f5dda6af56de6346aba
- https://github.com/spatie/laravel-medialibrary/releases/tag/11.23.0
- https://www.vulncheck.com/advisories/spatie-laravel-media-library-file-upload-restriction-bypass-via-fileadder-php