PT-2026-57850 · Unknown · Laravel-Mediable

Vulncheck + 1 · Published 2026-07-13 · Updated 2026-07-13 · CVE-2026-49972

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Laravel-Mediable versions prior to 7.0.0

Description An issue exists where unauthenticated attackers can achieve remote code execution by uploading files with double extensions, such as shell.php.jpg. The PATHINFO FILENAME extraction preserves the inner .php extension in the base name. On misconfigured Apache or nginx servers that execute any filename containing .php as PHP, the stored file is interpreted as executable code. This occurs because the outer .jpg extension allows the file to bypass MIME type, extension, and aggregate type validation checks.

Recommendations Update Laravel-Mediable to version 7.0.0 or later.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-49972

Affected Products

Laravel-Mediable

References · 5

• https://github.com/plank/laravel-mediable/commit/49e3583bed13423611b3391f89e6b002571eed73 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-49972 · Security Note
• https://github.com/plank/laravel-mediable/releases/tag/7.0.0 · Note
• https://vulncheck.com/advisories/laravel-mediable-file-upload-rce-via-extension-bypass · Note
• https://twitter.com/VulmonFeeds/status/2076762760231211287 · Twitter Post