Vulnerability Description
Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading a file with an embedded PHP extension disguised within a double extension such as shell.php.jpg. The PATHINFO_FILENAME extraction preserves the inner .php extension in the base name, and on misconfigured Apache or nginx servers that execute any filename containing .php as PHP, the stored file is interpreted as executable code while all MIME type, extension, and aggregate type validation checks pass due to the outer .jpg extension.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/plank/laravel-mediable/commit/49e3583bed13423611b3391f89e6b00
- https://github.com/plank/laravel-mediable/releases/tag/7.0.0
- https://www.vulncheck.com/advisories/laravel-mediable-file-upload-rce-via-extens
FAQ
What is CVE-2026-49972?
CVE-2026-49972 is a vulnerability with a CVSS score of 8.8 (HIGH). Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading a file with an embedded PHP extension disguised w...
How severe is CVE-2026-49972?
CVE-2026-49972 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-49972?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.