What’s Vulnerable › Vulnerabilities

CVE-2026-49972: Laravel-Mediable < 7.0.0 File Upload RCE via Extension Bypass

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-13 · updated 2026-10-24
• Weakness: CWE-434

Description

Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading a file with an embedded PHP extension disguised within a double extension such as shell.php.jpg. The PATHINFO_FILENAME extraction preserves the inner .php extension in the base name, and on misconfigured Apache or nginx servers that execute any filename containing .php as PHP, the stored file is interpreted as executable code while all MIME type, extension, and aggregate type validation checks pass due to the outer .jpg extension.

Affected products

• plank laravel-mediable: before 7.0.0 — fixed in 7.0.0

How to fix

Upgrade to a fixed version: plank laravel-mediable 7.0.0. Check the vendor advisory for mitigations.

References

• https://github.com/plank/laravel-mediable/commit/49e3583bed13423611b3391f89e6b002571eed73
• https://github.com/plank/laravel-mediable/releases/tag/7.0.0
• https://www.vulncheck.com/advisories/laravel-mediable-file-upload-rce-via-extension-bypass

Get alerted when CVE-2026-49972 or the next vulnerability affects your stack