Executive brief
Laravel-Mediable is a library used by web applications to manage media files. A security flaw allows attackers to force the server to make unauthorized requests to internal systems or cloud services. This could lead to the theft of sensitive internal data or cloud access credentials, potentially compromising the entire hosting environment.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Laravel-Mediable's RemoteUrlAdapter when processing unvalidated user-supplied URLs via MediaUploader::fromSource(). The component failed to validate destination hostnames and URL schemes, allowing attackers to target internal RFC-1918 addresses, loopback interfaces, or cloud metadata services (e.g., IMDS). Attackers can also use the file:// URI scheme to read local system files. The vulnerability is mitigated in version 7.0.0 by introducing an allowlist for trusted hostnames and schemes, and by automatically blocking private IP addresses and localhost by default. Exploitation typically requires the ability to provide a source URL to a media upload endpoint.
Affected products
- Plank laravel-mediable < 7.0.0
Timeline
- 2026-06-12: patched: Fix committed to repository
- 2026-07-13: advisory: NVD and VulnCheck advisory published
- 2026-07-13: disclosed: Version 7.0.0 released