Which versions of PHP are affected by CVE-2026-4809?

Organizations using plank/laravel-mediable PHP package through version 6.4.0 face critical remote code execution risk, as the library fails to validate file types during upload, allowing attackers to…

How to fix or mitigate CVE-2026-4809?

Within 24 hours: Identify all applications using plank/laravel-mediable and document affected versions; immediately disable file upload functionality if operationally feasible or restrict uploads to authenticated users only. Within 7 days: Implement network-level controls (see compensating controls below) and conduct file system audit for suspicious PHP files in web-accessible directories created after deployment. Within 30 days: Monitor vendor security advisory channels and GitHub repository for patch release; establish upgrade plan to patched version upon availability; if no patch emerges, evaluate alternative media handling libraries.

PHP CVE-2026-4809

Q: What is the CVSS score of CVE-2026-4809?

CVE-2026-4809 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-16164 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-03-26 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

PHP File Upload RCE

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 26, 2026 - 11:22 euvd

EUVD-2026-16164

Analysis Generated

Mar 26, 2026 - 11:22 vuln.today

CVE Published

Mar 26, 2026 - 11:16 nvd

CRITICAL 9.3

DescriptionCVE.org

plank/laravel-mediable through version 6.4.0 can allow upload of a dangerous file type when an application using the package accepts or prefers a client-supplied MIME type during file upload handling. In that configuration, a remote attacker can submit a file containing executable PHP code while declaring a benign image MIME type, resulting in arbitrary file upload. If the uploaded file is stored in a web-accessible and executable location, this may lead to remote code execution. At the time of publication, no patch was available and the vendor had not responded to coordinated disclosure attempts.

AnalysisAI

Remote code execution in plank/laravel-mediable PHP package through version 6.4.0 allows unauthenticated attackers to upload executable PHP files disguised with benign MIME types, achieving arbitrary code execution when files land in web-accessible directories. EPSS score of 0.39% (60th percentile) indicates low observed exploitation probability, though SSVC analysis confirms the vulnerability is automatable with total technical impact. No vendor-released patch identified at time of analysis despite coordinated disclosure attempts.

Technical ContextAI

The vulnerability affects plank/laravel-mediable, a PHP media handling library for Laravel applications, specifically versions at or below 6.4.0 (confirmed via EUVD-2026-16164). The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type), where the package fails to validate file contents independently of client-supplied MIME type headers. When applications using this library trust client-provided MIME types during upload validation rather than performing server-side content inspection, attackers can bypass type restrictions by declaring safe MIME types (e.g., image/jpeg) while uploading files containing PHP code. The vulnerability chain requires both the misconfigured use of the library and storage of uploads in web-accessible directories with script execution enabled.

RemediationAI

No vendor-released patch identified at time of analysis, as the vendor has not responded to coordinated disclosure attempts. Organizations using plank/laravel-mediable version 6.4.0 or earlier should implement immediate mitigations: reject client-supplied MIME types entirely and perform server-side file type validation based on file content inspection (magic bytes analysis), store all uploaded files outside web-accessible directories or in locations with script execution disabled via web server configuration, implement strict file extension allowlists validated against actual file content, and apply defense-in-depth measures including Web Application Firewall rules to block PHP file uploads and Content Security Policy headers to limit execution contexts. Monitor the project repository at https://github.com/plank/laravel-mediable for future security updates, or consider migrating to alternative Laravel media handling solutions with active security maintenance.