Executive brief
Laravel-Mediable is a popular library for managing file uploads in Laravel applications. A path traversal vulnerability in the File::sanitizePath() function allows authenticated users to upload files to arbitrary locations on the server, potentially writing PHP files to sensitive directories and achieving remote code execution.
Technical details
This is a path traversal vulnerability (CWE-22) in the File::sanitizePath() function within Laravel-Mediable versions before 7.0.0. The vulnerability stems from an insufficiently restrictive regex pattern in the sanitization logic that permits both dot (.) and forward slash (/) characters, combined with an ineffective trailing trim() operation. This allows an attacker who has authentication privileges and can control the directory argument passed to MediaUploader::toDestination() to bypass path sanitization. An authenticated attacker can exploit this to write uploaded files to sensitive locations including the application root, configuration directories containing environment variables, or other writable directories, leading to remote code execution if PHP files are uploaded. The patch is available in version 7.0.0 and later.
Affected products
- Plank Laravel-Mediable before 7.0.0
Timeline
- 2026-07-13: disclosed
- 2026-07-13: patched: Version 7.0.0 includes the fix