EUVD-2026-16164Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c) · only source for this CVE.
CVSS VectorVendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
Lifecycle Timeline
3DescriptionCVE.org
plank/laravel-mediable through version 6.4.0 can allow upload of a dangerous file type when an application using the package accepts or prefers a client-supplied MIME type during file upload handling. In that configuration, a remote attacker can submit a file containing executable PHP code while declaring a benign image MIME type, resulting in arbitrary file upload. If the uploaded file is stored in a web-accessible and executable location, this may lead to remote code execution. At the time of publication, no patch was available and the vendor had not responded to coordinated disclosure attempts.
AnalysisAI
Remote code execution in plank/laravel-mediable PHP package through version 6.4.0 allows unauthenticated attackers to upload executable PHP files disguised with benign MIME types, achieving arbitrary code execution when files land in web-accessible directories. EPSS score of 0.39% (60th percentile) indicates low observed exploitation probability, though SSVC analysis confirms the vulnerability is automatable with total technical impact. No vendor-released patch identified at time of analysis despite coordinated disclosure attempts.
Technical ContextAI
The vulnerability affects plank/laravel-mediable, a PHP media handling library for Laravel applications, specifically versions at or below 6.4.0 (confirmed via EUVD-2026-16164). The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type), where the package fails to validate file contents independently of client-supplied MIME type headers. When applications using this library trust client-provided MIME types during upload validation rather than performing server-side content inspection, attackers can bypass type restrictions by declaring safe MIME types (e.g., image/jpeg) while uploading files containing PHP code. The vulnerability chain requires both the misconfigured use of the library and storage of uploads in web-accessible directories with script execution enabled.
RemediationAI
No vendor-released patch identified at time of analysis, as the vendor has not responded to coordinated disclosure attempts. Organizations using plank/laravel-mediable version 6.4.0 or earlier should implement immediate mitigations: reject client-supplied MIME types entirely and perform server-side file type validation based on file content inspection (magic bytes analysis), store all uploaded files outside web-accessible directories or in locations with script execution disabled via web server configuration, implement strict file extension allowlists validated against actual file content, and apply defense-in-depth measures including Web Application Firewall rules to block PHP file uploads and Content Security Policy headers to limit execution contexts. Monitor the project repository at https://github.com/plank/laravel-mediable for future security updates, or consider migrating to alternative Laravel media handling solutions with active security maintenance.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today