Vulnerability Description
Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath() function that allows attackers to write uploaded files to arbitrary locations by controlling the directory argument passed to MediaUploader::toDestination(). Attackers can exploit the permissive character-class regex that allows both dot and slash characters combined with an ineffective trailing trim() call to bypass sanitization and upload files to sensitive locations such as the document root, environment configuration files, or application configuration directories, enabling remote code execution.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/plank/laravel-mediable/commit/6d1e7fb39922fdfb3b2d120e13f4eb2
- https://github.com/plank/laravel-mediable/releases/tag/7.0.0
- https://www.vulncheck.com/advisories/laravel-mediable-path-traversal-via-file-sa
FAQ
What is CVE-2026-49970?
CVE-2026-49970 is a vulnerability with a CVSS score of 8.8 (HIGH). Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath() function that allows attackers to write uploaded files to arbitrary locations by controlling the direc...
How severe is CVE-2026-49970?
CVE-2026-49970 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-49970?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.