Which versions of Laravel-Mediable are affected by CVE-2026-49972?

The plank/laravel-mediable package before version 7.0.0 contains a remote code execution vulnerability exploitable through double-extension file upload bypass; no public exploit identified at time of…. A patch is available.

How to fix or mitigate CVE-2026-49972?

Within 24 hours, inventory all applications and development environments currently using plank/laravel-mediable to establish exposure scope and criticality ranking. Within 7 days, upgrade affected instances to version 7.0.0 in staging environments, validate that file upload and media serving functionality remain intact, and review Apache/nginx configuration to confirm PHP execution is restricted to intended directories only. Within 30 days, complete deployment of 7.0.0 to all production instances, document server configuration changes made, and retain patch deployment records for compliance audit purposes.

Laravel-Mediable CVE-2026-49972

Q: What is the CVSS score of CVE-2026-49972?

CVE-2026-49972 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-13 VulnCheck

PHP Nginx RCE File Upload Apache Laravel Mediable

7.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

AC:H because RCE depends on an attacker-uncontrolled server misconfiguration executing .php-containing names; PR:L follows the vendor vector given the auth conflict; C/I/A:H reflect full webshell RCE.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 13, 2026 - 19:28 vuln.today

Analysis Generated

Jul 13, 2026 - 19:28 vuln.today

CVE Published

Jul 13, 2026 - 18:16 cve.org

HIGH 7.7

DescriptionCVE.org

Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading a file with an embedded PHP extension disguised within a double extension such as shell.php.jpg. The PATHINFO_FILENAME extraction preserves the inner .php extension in the base name, and on misconfigured Apache or nginx servers that execute any filename containing .php as PHP, the stored file is interpreted as executable code while all MIME type, extension, and aggregate type validation checks pass due to the outer .jpg extension.

AnalysisAI

Remote code execution in the plank/laravel-mediable package before 7.0.0 lets attackers upload a double-extension file such as shell.php.jpg that passes all MIME, extension, and aggregate-type validation because of the trailing .jpg, yet retains an inner .php in its stored basename. On Apache/nginx servers misconfigured to execute any filename containing .php, the stored artifact runs as PHP. Reported by VulnCheck with a vendor patch in 7.0.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Laravel-Mediable is a Laravel media-management package handling uploads and attachment of files to Eloquent models. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): the uploader validates the outer/last extension (.jpg) and the derived MIME/aggregate type, but the filename is stored via PHP's PATHINFO_FILENAME, which strips only the final extension and thus preserves the inner .php in the base name (shell.php.jpg → basename shell.php). The vulnerability only becomes code execution when it meets a permissive web-server configuration - Apache with a loose AddHandler/SetHandler or nginx with a broad \.php location that passes any filename containing .php to the PHP-FPM handler - making this a chained application-plus-server-misconfiguration weakness. The affected artifact per CPE is cpe:2.3:a:plank:laravel-mediable:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to Laravel-Mediable 7.0.0 or later (Vendor-released patch: 7.0.0), which is a dedicated security release; apply the fix from commit 49e3583bed13423611b3391f89e6b002571eed73 per https://github.com/plank/laravel-mediable/releases/tag/7.0.0. Version 7.0.0 also introduces mediable.forbidden_file_extensions / MediaUploader::setForbiddenExtensions(), so blacklist php, phtml, php3-8, and phar after upgrading. Where immediate upgrade is not possible, harden the web server: on Apache remove broad AddHandler/SetHandler application/x-httpd-php rules and use FilesMatch "\.php$" (anchored) so only trailing-.php files execute; on nginx replace any location ~ \.php with location ~ \.php$ and add try_files $uri =404 in the PHP block - this closes the double-extension execution path with essentially no functional side effect. Additionally, store uploads outside the web root or serve them from a domain/path with PHP execution disabled (side effect: requires adjusting media-serving URLs), and rename stored files to remove any embedded .php segment.