EUVD-2026-85706
GHSA-phwc-h4xx-5vvv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Laravel-Mediable upload endpoint
-
DeliveryUpload payload named .pht
-
ExploitBypass verifyExtension/sanitizeFileName blocklist
-
ExecutionFile written to web-accessible path
-
PersistRequest file, Apache runs it as PHP
-
ImpactRCE as web-server user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires: (1) the application to use Laravel-Mediable 7.0.0 or 7.0.1 and expose a reachable upload path through MediaUploader::verifyExtension(); (2) uploaded files stored in a web-accessible directory served by Apache; and (3) an Apache configuration whose default FilesMatch directive maps the .pht extension to the PHP handler - the documented default on Debian and Ubuntu. Limiting factors: the .pht-to-PHP mapping is Debian/Ubuntu-specific, so servers on other OSes or with a hardened FilesMatch/handler config are not vulnerable; PR:N holds only if the consuming application does not gate the upload endpoint behind authentication; and versions outside 7.0.0-7.0.1 (including 7.0.2+) are unaffected. |
| Impact | This is a genuine high-priority issue, not a paper-tiger high-CVSS. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, 9.3) describes remote, unauthenticated, low-complexity code execution - consistent with a straightforward file-upload-to-RCE primitive. The mechanism is concrete and well-understood: an incomplete blocklist patch for CVE-2026-49972 that included 'phpt' but omitted 'pht', combined with Apache's documented default FilesMatch behavior on Debian/Ubuntu that treats .pht as executable PHP. That specificity raises confidence the flaw is real and reliably exploitable where reachable. Countervailing signals: no EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automated exploitation yet - exploitation status is 'no public exploit identified at time of analysis'. Note also that PR:N assumes the consuming application exposes the MediaUploader path without authentication and stores uploads in a web-served directory; that is an application-integration assumption the library CVE cannot itself guarantee. Net: patch promptly (upgrade to 7.0.2) because the technical bar is low and the impact is full RCE, but real-world blast radius is bounded by the library's modest deployment footprint and by whether each app exposes an unauthenticated upload endpoint served by Apache on Debian/Ubuntu. |
| Exploit ScenarioDerived | An attacker locates an application built on Laravel-Mediable 7.0.0/7.0.1 that accepts file uploads through MediaUploader and stores them in an Apache-served directory on Debian/Ubuntu. They upload a malicious PHP payload named with a .pht extension, which passes verifyExtension() and sanitizeFileName() because 'pht' is missing from the forbidden_extensions blocklist, then request the stored file so Apache's default FilesMatch directive executes it as PHP, yielding remote code execution as the web-server user. No public POC was provided, though VulnCheck published an advisory detailing the technique. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Unauthenticated file upload in Laravel-Mediable 7.0.0 and 7.0.1 lets a remote attacker upload a .pht file that passes MediaUploader::verifyExtension() and File::sanitizeFileName(), which is then written to disk and executed as PHP when requested on Apache servers configured with the Debian/Ubuntu default FilesMatch handler, resulting in remote code execution as the web server process. The flaw is an incomplete fix for CVE-2026-49972: the forbidden_extensions list added in config/mediable.php blocks phpt but omits pht, an Apache-recognized PHP extension. Vendor-released patch 7.0.2 closes the gap; no public exploit code was identified at time of analysis, but exploitation is trivial where the upload endpoint is reachable and unauthenticated, so the issue warrants high priority despite the platform-specific precondition.
RemediationAI
Upgrade to Laravel-Mediable 7.0.2, which is the vendor-released patch and adds pht to the default disallowed extensions (commit 8ddb0e5b300084e91ad2cb18a6e7bc768bb7b008, PR #396, release notes at https://github.com/plank/laravel-mediable/releases/tag/7.0.2); if the package is pinned by a lockfile or the config file has been published into the application, you must both upgrade and republish or manually extend config/mediable.php's forbidden_extensions to include pht (and consider phtml, phps, php5-php8, and other variant handlers). Where immediate upgrade is not possible, apply layered compensating controls: remove pht (and sibling extensions) from the Apache PHP handler mapping or restrict the FilesMatch directive so it no longer matches .pht, accepting that this can break legitimate applications that genuinely rely on that extension; or configure storage so uploads are held outside the web root and streamed through a controller or CDN with a fixed Content-Type and Content-Disposition, which prevents direct execution but adds application code and bandwidth overhead; or terminate upload routing at the web server with a deny rule for non-allowlisted extensions before requests reach Laravel, which requires config change management and may be bypassed if other upload paths exist. Note that authentication on the consuming upload endpoint is not provided by the library - applications that already gate uploads behind authentication reduce the effective risk, while public upload forms should be treated as directly exploitable. Vendor and third-party guidance is available at https://www.vulncheck.com/advisories/laravel-mediable-rce-via-pht-file-upload.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Laravel-Mediable (package plank/laravel-mediable, CPE cpe:2.3:a:plank:laravel-mediable) is a Laravel media-attachment library that validates uploads through MediaUploader::verifyExtension() and sanitizes names via File::sanitizeFileName(), keying both on an allow/deny list in config/mediable.php. CVE-2026-49972 previously exposed an unrestricted-upload path (CWE-434) and was mitigated by adding a forbidden_extensions blocklist, but that fix enumerated phpt while omitting pht. Both phpt and pht are mapped to the PHP handler by Apache's stock FilesMatch directive on Debian and Ubuntu (e.g. <FilesMatch ".+\.(php|phpt|pht|phtml)$"> in conf-enabled/php*.conf), so a file named with the .pht extension survives every library-level check, lands in the media directory, and is interpreted as PHP when fetched over HTTP. The root cause is therefore a denylist-completeness failure in sensitive-file-type enforcement rather than a parsing or memory-safety defect: the validation logic is sound but its configuration data is incomplete, a classic incomplete-patch pattern that recurs whenever a security fix enumerates extensions instead of allowing only a safe set.
Know when Laravel gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated upload leading to arbitrary PHP execution gives full C/I/A on the host process; AC:L because the .pht-to-PHP mapping is the default on Debian/Ubuntu Apache.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49972 in which the .pht extension is absent from the forbidden_extensions blocklist in config/mediable.php. The blocklist introduced to address CVE-2026-49972 includes phpt but omits pht, which Apache executes as PHP via the default FilesMatch directive on Debian and Ubuntu systems. An attacker can upload a .pht file that passes all validation in MediaUploader::verifyExtension() and File::sanitizeFileName() because pht is not present in the blocklist, causing the file to be written to disk and executed as PHP when requested, enabling remote code execution with the privileges of the web server process.
Articles & Coverage 1
Executive ViewAI
A critical remote code execution vulnerability affects Laravel-Mediable versions 7.0.0 and 7.0.1, allowing an attacker who can reach an application's file-upload feature to execute arbitrary code as the web server process on Apache deployments configured with the Debian/Ubuntu default PHP handler. Any business unit running the affected package on that web stack is exposed to full application compromise, including access to customer records, credentials, and connected back-end systems, and should treat remediation as an urgent priority. No public exploit code was identified at time of analysis, but the platform-specific preconditions are common enough that exposure should be assumed until inventory confirms otherwise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwo
Laravel Livewire v3 through v3.6.3 contains a critical remote code execution vulnerability (CVE-2025-54068, CVSS 9.8) th
LaRecipe versions prior to 2.8.1 contain a Server-Side Template Injection (SSTI) vulnerability that can lead to Remote C
File upload bypass in FreeScout 1.8.206 — patch bypass for CVE-2026-27636. PoC and patch available. CVSS 10.0.
Remote code execution in FreeScout prior to version 1.8.206 allows authenticated users to upload `.htaccess` files that
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unseri
Dokans SaaS e-commerce platform v3.9.2 has a CVSS 10.0 authentication bypass allowing unauthenticated attackers to obtai
Predictable password reset tokens in FreeScout help desk before 1.8.206. Weak random number generation allows attackers
Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address
Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauth
A vulnerability was found in laravel 5.1 and classified as problematic. Rated critical severity (CVSS 9.8), this vulnera
Databasement instances before 1.8.2 allow an authenticated user to achieve remote code execution by injecting path-redir
Exploit-DB