PT-2026-44978 · Spatie · Laravel-Medialibrary

Vulncheck + 1 · Published 2026-05-29 · Updated 2026-05-29 · CVE-2026-48555

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Spatie Laravel Media Library versions prior to 11.23.0

Description An issue exists that allows remote attackers to cause the server to issue arbitrary outbound HTTP requests. This occurs when user-controlled URLs are passed to the addMediaFromUrl() function within the InteractsWithMedia.php file. This is a server-side request forgery, which is a flaw where an attacker can force a server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing.

Recommendations Update to version 11.23.0 or later. As a temporary workaround, restrict or validate user-controlled URLs passed to the addMediaFromUrl() function.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-48555

Affected Products

Laravel-Medialibrary

References · 8

• https://github.com/spatie/laravel-medialibrary/commit/608ea03703d3887c46434f5dda6af56de6346aba · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-48555 · Security Note
• https://github.com/spatie/laravel-medialibrary/pull/3939 · Note
• https://github.com/spatie/laravel-medialibrary/releases/tag/11.23.0 · Note
• https://twitter.com/VulmonFeeds/status/2060484232409915883 · Twitter Post
• https://vulncheck.com/advisories/spatie-laravel-media-library-ssrf-via-addmediafromurl · Note
• https://twitter.com/CVEnew/status/2060470663215821122 · Twitter Post
• https://t.me/CVEtracker/55310 · Telegram Post