Laravel-Mediable
CVE-2026-49970
HIGH
GHSA-xv8g-76mx-2rxc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable low-complexity upload sink requires an authenticated actor able to influence the directory argument (PR:L), and arbitrary file write to RCE yields full C/I/A impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath() function that allows attackers to write uploaded files to arbitrary locations by controlling the directory argument passed to MediaUploader::toDestination(). Attackers can exploit the permissive character-class regex that allows both dot and slash characters combined with an ineffective trailing trim() call to bypass sanitization and upload files to sensitive locations such as the document root, environment configuration files, or application configuration directories, enabling remote code execution.
AnalysisAI
Arbitrary file write in the Plank Laravel-Mediable package (before 7.0.0) lets an attacker who influences the destination directory of MediaUploader::toDestination() plant uploaded files outside the intended storage path, culminating in remote code execution. The flaw stems from a weak File::sanitizePath() regex that permits both '.' and '/' characters plus an ineffective trailing trim(), so '../' traversal sequences survive sanitization and files can land in the document root, .env, or config directories. No public exploit has been identified at time of analysis, but a vendor patch (7.0.0) exists and the issue was reported by VulnCheck.
Technical ContextAI
Laravel-Mediable is a PHP/Composer library (cpe:2.3:a:plank:laravel-mediable) that adds polymorphic media attachment and file-upload handling to Laravel applications. The vulnerability is a classic CWE-22 Improper Limitation of a Pathname to a Restricted Directory: the File::sanitizePath() helper used by MediaUploader::toDestination() relies on a permissive character-class regex that whitelists dot and slash characters and then only trims trailing separators, rather than canonicalizing the path or stripping interior '.' segments. Because the directory argument is treated as attacker-influenceable, traversal tokens such as '../' pass through, allowing writes anywhere the PHP process has permission. The 7.0.0 fix changes directory validation to strip '.' characters from each path segment, neutralizing '../' patterns.
RemediationAI
Vendor-released patch: 7.0.0 - upgrade the plank/laravel-mediable dependency to 7.0.0 or later (composer require plank/laravel-mediable:^7.0), which strips '.' characters from path segments in directory validation and closes the traversal (fix commit 6d1e7fb39922fdfb3b2d120e13f4eb2e653ae082, release notes at https://github.com/plank/laravel-mediable/releases/tag/7.0.0). Where an immediate upgrade is not possible, the effective compensating control is to stop passing user-controlled input into the directory argument of MediaUploader::toDestination(): hardcode or server-side-map destination directories, and reject any directory value containing '.', '/', or '\' before it reaches the uploader - the trade-off is loss of any legitimate feature that lets users choose upload subfolders. Additionally, run the PHP/web-server process under a least-privileged user without write access to the document root, .env, or config directories so a residual traversal cannot land executable or config files. Note that 7.0.0 is a broader security release also addressing SSRF (CVE-2026-49969) and SVG stored XSS (CVE-2026-49971), so upgrading is preferable to point mitigations.
More in Laravel Mediable
View allRemote code execution in the plank/laravel-mediable package before 7.0.0 lets attackers upload a double-extension file s
Server-side request forgery in Laravel-Mediable before 7.0.0 enables network-accessible, low-privilege attackers to issu
Stored XSS in Laravel-Mediable before 7.0.0 allows network-accessible, unauthenticated attackers to persist malicious Ja
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today