Executive brief
Laravel-Mediable is a library used by web applications to manage file uploads and media attachments. A security flaw allows attackers to upload malicious files that appear to be harmless images but actually contain executable code. If successfully exploited, an attacker could take full control of the web server, potentially leading to data theft or service disruption.
Technical details
Laravel-Mediable before version 7.0.0 contains an unrestricted file upload vulnerability (CWE-434). The vulnerability exists because the PATHINFO_FILENAME extraction logic preserves inner extensions in the base name. An attacker can upload a file with a double extension (e.g., 'shell.php.jpg'); while the library validates the outer '.jpg' extension and MIME type, the file is stored with the '.php' segment intact. On Apache or Nginx servers configured to execute any filename containing '.php' as a script, this results in remote code execution. The issue is mitigated in version 7.0.0 by introducing a forbidden extension blacklist and sanitizing nested extensions (e.g., converting 'script.php.jpg' to 'script-php.jpg').
Affected products
- Plank laravel-mediable < 7.0.0
Timeline
- 2026-07-13: advisory: NVD and VulnCheck published the advisory
- 2026-07-13: patched: Version 7.0.0 released with security fixes