# CVE-2026-93352: Laravel-Mediable incomplete patch for file upload RCE

Source: https://junglewise.ai/threats/cve-2026-93352-laravel-mediable-7-0-0-before-7-0-2-contains-an-incomplete-patch  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-93352 · Severity: critical · CVSS 9.8 · Published 2026-09-23

Laravel-Mediable is a file upload and media management library for the Laravel web framework. A patch for a previous vulnerability was incomplete, leaving the .pht file extension unblocked. On Apache servers with standard configuration, uploading a .pht file allows an attacker to execute arbitrary code as the web server, leading to complete system compromise.

Technologies: [Plank Laravel-Mediable](https://junglewise.ai/threats/technologies/laravel-mediable). Vendors: [Plank](https://junglewise.ai/threats/vendors/plank).

## Quick answers

**Is CVE-2026-93352 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93352 being exploited in the wild.

**How severe is CVE-2026-93352?** Critical severity, with a CVSS score of 9.8, published 23 September 2026.

**Which products and versions are affected?** Plank Laravel-Mediable 7.0.0 before 7.0.2.

**Is there a fix for CVE-2026-93352?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-93352 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-93352?** Check whether you run Plank Laravel-Mediable at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerable library fails to block .pht files in its forbidden_extensions configuration despite patching CVE-2026-49972, which blocked .phpt. Apache's default FilesMatch directive on Debian/Ubuntu systems executes .pht files as PHP. An attacker can bypass MediaUploader::verifyExtension() and File::sanitizeFileName() validation by uploading a .pht file, which is written to disk and executed as PHP code when accessed, granting RCE with web server privileges. The fix adds 'pht' to the blocklist in config/mediable.php.

## Affected products

- Plank Laravel-Mediable 7.0.0 before 7.0.2

## Timeline

- 2026-09-23: disclosed

## References

- [https://github.com/plank/laravel-mediable/commit/8ddb0e5b300084e91ad2cb18a6e7bc768bb7b008](https://github.com/plank/laravel-mediable/commit/8ddb0e5b300084e91ad2cb18a6e7bc768bb7b008)
- [https://github.com/plank/laravel-mediable/pull/396](https://github.com/plank/laravel-mediable/pull/396)

## Related threats

- [Plank Laravel-Mediable remote code execution via double extension bypass](https://junglewise.ai/threats/cve-2026-49972-plank-laravel-mediable-remote-code-execution-via-double-extension)
- [Plank Laravel-Mediable path traversal in File::sanitizePath](https://junglewise.ai/threats/cve-2026-49970-plank-laravel-mediable-path-traversal-in-file-sanitizepath)
- [Plank Laravel-Mediable SSRF in MediaUploader](https://junglewise.ai/threats/cve-2026-49969-plank-laravel-mediable-ssrf-in-mediauploader)