Laravel-Mediable CVE-2026-49972

Requires the target to run laravel-mediable before 7.0.0 AND host it on an Apache or nginx server misconfigured to execute any filename containing '.php' (e.g., unanchored \.php handler/location rules rather than \.php$). The attacker must reach a Mediable file-upload endpoint and supply a crafted double-extension file (inner executable extension, benign outer extension such as shell.php.jpg) so validation keys on the .jpg while PATHINFO_FILENAME preserves shell.php in the stored name. Limiting factors: exploitation fails entirely on correctly configured servers (files served statically), and the authentication level is unconfirmed - the description says 'unauthenticated' while the vendor CVSS uses PR:L, so whether the upload endpoint requires a login must be verified per deployment.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H) scores 7.7 (High), and the AT:P (Attack Requirements: Present) metric correctly captures that exploitation depends on a condition outside the attacker's control - a misconfigured Apache/nginx server that executes .php-containing filenames. That single dependency is the dominant risk limiter: on a correctly configured server the uploaded file is served as a static .jpg and never executes, so real-world impact is conditional rather than universal. Note a conflict to verify: the description states 'unauthenticated attackers,' but the vendor vector uses PR:L (authenticated) - treat the auth requirement as not confirmed from available data and verify against the specific upload endpoint's protection. No EPSS score, no KEV listing, and no POC were provided, so despite high technical impact (full RCE) this reads as a real-but-conditional priority for teams running affected versions on permissive server configs, not a mass-exploited emergency.

An attacker uploads shell.php.jpg through the application's Mediable-backed upload feature; the outer .jpg satisfies every MIME/extension/aggregate check while the stored basename retains shell.php. On an Apache/nginx server configured to execute any filename containing .php, the attacker then requests the stored file's URL and their embedded PHP webshell runs on the server. No public exploit code was identified at time of analysis; given AV:N/AC:L the request itself is trivial, but AT:P means success hinges on the server misconfiguration being present.