PT-2026-57847 · Unknown · Laravel-Mediable

Vulncheck + 1 · Published 2026-07-13 · Updated 2026-07-13 · CVE-2026-49969

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Laravel-Mediable versions prior to 7.0.0

Description An issue allows remote attackers to issue arbitrary HTTP requests from the server by providing unvalidated URLs to endpoints that use the MediaUploader::fromSource() function. Through the RemoteUrlAdapter, attackers can target RFC-1918 addresses (private IP addresses used in local networks), loopback interfaces, cloud metadata endpoints, or file:// URIs. This can lead to access to internal infrastructure, retrieval of sensitive files, and exfiltration of cloud credentials, such as IAM tokens from instance metadata services.

Recommendations Update Laravel-Mediable to version 7.0.0 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-49969

Affected Products

Laravel-Mediable

References · 5

• https://github.com/plank/laravel-mediable/commit/7e9e3000fa05fe16e678f15bfb51a091e60c2cb8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-49969 · Security Note
• https://github.com/plank/laravel-mediable/releases/tag/7.0.0 · Note
• https://twitter.com/VulmonFeeds/status/2076770445009854887 · Twitter Post
• https://vulncheck.com/advisories/laravel-mediable-ssrf-via-remoteurladapter-url-handling · Note