What’s Vulnerable › Vulnerabilities

CVE-2021-45040

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-03-17 · updated 2026-06-17
• Weakness: CWE-434

Description

The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel allows remote attackers to upload executable files via the uploads route.

Affected products

• spatie Laravel Media Library: through 1.17.10; from 2.0.0 through 2.1.6

References

• https://cybersecthreat.com/2022/03/14/cve-2021-45040/
• https://spatie.be/docs/laravel-medialibrary/v9/handling-uploads-with-media-library-pro/processing-uploads-on-the-server
• https://cybersecthreat.com/2022/03/14/cve-2021-45040/
• https://spatie.be/docs/laravel-medialibrary/v9/handling-uploads-with-media-library-pro/processing-uploads-on-the-server

Get alerted when CVE-2021-45040 or the next vulnerability affects your stack