Is CVE-2026-49972 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49972 being exploited in the wild.

How severe is CVE-2026-49972?

High severity, with a CVSS score of 8.8, published 13 July 2026.

Which products and versions are affected?

Plank Laravel-Mediable < 7.0.0.

Is there a fix for CVE-2026-49972?

A patch was published on 2026-07-13: Version 7.0.0 released with security fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49972 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-49972?

Check whether you run Plank Laravel-Mediable at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49972: Plank Laravel-Mediable remote code execution via double extension bypass

Q: Is there a fix for CVE-2026-49972?

A patch was published on 2026-07-13: Version 7.0.0 released with security fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-49972 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-49972?

Check whether you run Plank Laravel-Mediable at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49972 · Severity: high · CVSS 8.8 · Published 2026-07-13

Laravel-Mediable is a library used by web applications to manage file uploads and media attachments. A security flaw allows attackers to upload malicious files that appear to be harmless images but actually contain executable code. If successfully exploited, an attacker could take full control of the web server, potentially leading to data theft or service disruption.

Technologies: Plank Laravel-Mediable. Vendors: Plank.

Quick answers

Is CVE-2026-49972 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49972 being exploited in the wild.
How severe is CVE-2026-49972?: High severity, with a CVSS score of 8.8, published 13 July 2026.
Which products and versions are affected?: Plank Laravel-Mediable < 7.0.0.
Is there a fix for CVE-2026-49972?: A patch was published on 2026-07-13: Version 7.0.0 released with security fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49972 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-49972?: Check whether you run Plank Laravel-Mediable at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Laravel-Mediable before version 7.0.0 contains an unrestricted file upload vulnerability (CWE-434). The vulnerability exists because the PATHINFO_FILENAME extraction logic preserves inner extensions in the base name. An attacker can upload a file with a double extension (e.g., 'shell.php.jpg'); while the library validates the outer '.jpg' extension and MIME type, the file is stored with the '.php' segment intact. On Apache or Nginx servers configured to execute any filename containing '.php' as a script, this results in remote code execution. The issue is mitigated in version 7.0.0 by introducing a forbidden extension blacklist and sanitizing nested extensions (e.g., converting 'script.php.jpg' to 'script-php.jpg').

Affected products

Plank laravel-mediable < 7.0.0

Timeline

2026-07-13: advisory: NVD and VulnCheck published the advisory
2026-07-13: patched: Version 7.0.0 released with security fixes

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.