PT-2026-44994 · Spatie · Laravel-Medialibrary

Vulncheck + 1 · Published 2026-05-29 · Updated 2026-05-29 · CVE-2026-48557

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Spatie Laravel Media Library versions prior to 11.23.0

Description A file upload restriction bypass exists in the defaultSanitizer() function of the FileAdder class. The sanitizer only validates the final filename suffix, which allows files with double extensions, such as shell.php.jpg, to bypass the blocklist because pathinfo() preserves inner stems in the saved filenames. Additionally, the blocklist fails to include several executable extensions, such as .php6, .shtml, and .htaccess. While the double-extension bypass requires a legacy Apache AddHandler configuration to execute PHP, the bypass involving the incomplete blocklist does not.

Recommendations Update to version 11.23.0 or later.

Fix

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-184

Related Identifiers

CVE-2026-48557

Affected Products

Laravel-Medialibrary

References · 7

• https://github.com/spatie/laravel-medialibrary/commit/608ea03703d3887c46434f5dda6af56de6346aba · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-48557 · Security Note
• https://github.com/spatie/laravel-medialibrary/releases/tag/11.23.0 · Note
• https://github.com/spatie/laravel-medialibrary/pull/3939 · Note
• https://twitter.com/VulmonFeeds/status/2060481672580112433 · Twitter Post
• https://t.me/CVEtracker/55311 · Telegram Post
• https://vulncheck.com/advisories/spatie-laravel-media-library-file-upload-restriction-bypass-via-fileadder-php · Note