Laravel-Mediable
CVE-2026-49969
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable with low privileges; scope change because SSRF reaches external systems; high confidentiality impact reflects IAM credential exfiltration from cloud metadata endpoints.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that allows remote attackers to issue arbitrary HTTP requests from the server by supplying unvalidated caller-controlled URLs to endpoints backed by MediaUploader::fromSource(). Attackers can craft URLs targeting RFC-1918 addresses, loopback interfaces, cloud metadata endpoints, or file:// URIs through RemoteUrlAdapter to reach internal infrastructure, retrieve sensitive files, and exfiltrate cloud credentials such as IAM tokens from instance metadata services.
AnalysisAI
Server-side request forgery in Laravel-Mediable before 7.0.0 enables network-accessible, low-privilege attackers to issue arbitrary HTTP requests originating from the server by supplying unvalidated URLs to any application endpoint backed by MediaUploader::fromSource(). The RemoteUrlAdapter class accepts caller-controlled URLs without restricting schemes, IP ranges, or hostnames, allowing requests to RFC-1918 addresses, loopback interfaces, file:// URIs, and cloud instance metadata endpoints such as AWS IMDSv1 at 169.254.169.254. In cloud deployments, successful exploitation can yield IAM temporary credentials, enabling privilege escalation far beyond the base CVSS score of 5.3 would suggest. No public exploit or CISA KEV listing exists at time of analysis.
Technical ContextAI
Laravel-Mediable (cpe:2.3:a:plank:laravel-mediable:*:*:*:*:*:*:*:*) is a PHP Composer package for the Laravel framework that manages media upload pipelines and file storage. Its RemoteUrlAdapter component is responsible for fetching remote media by URL on behalf of the application. CWE-918 (Server-Side Request Forgery) describes the root cause: the adapter passed caller-supplied URLs directly to a server-side HTTP client without validating the destination scheme, hostname, or resolved IP address. This is a classic SSRF pattern where the trust boundary between application-controlled and attacker-controlled input collapses at the URL ingestion point. The fix in 7.0.0 introduces allowlist-based controls via mediable.allowed_remote_hosts and mediable.allowed_remote_schemes, and adds default blocking of private IP ranges and localhost when no allowlist is configured.
RemediationAI
Upgrade to Laravel-Mediable 7.0.0 immediately - the vendor designates this a security release and strongly recommends upgrading. The release is available at https://github.com/plank/laravel-mediable/releases/tag/7.0.0, with the underlying patch commit at https://github.com/plank/laravel-mediable/commit/7e9e3000fa05fe16e678f15bfb51a091e60c2cb8. After upgrading, configure mediable.allowed_remote_hosts to an explicit allowlist of trusted external hostnames and restrict mediable.allowed_remote_schemes to https only, which is the secure default in 7.0.0. If immediate patching is not possible, block outbound HTTP/HTTPS connections from the application server to RFC-1918 address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254, fd00::/8) at the host or network firewall layer - note this may break legitimate internal API integrations and requires careful enumeration before deployment. Disabling RemoteUrlAdapter entirely in the source adapter configuration is a zero-risk alternative if remote URL ingestion is not a required application feature.
More in Laravel Mediable
View allArbitrary file write in the Plank Laravel-Mediable package (before 7.0.0) lets an attacker who influences the destinatio
Remote code execution in the plank/laravel-mediable package before 7.0.0 lets attackers upload a double-extension file s
Stored XSS in Laravel-Mediable before 7.0.0 allows network-accessible, unauthenticated attackers to persist malicious Ja
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today