spatie laravel-medialibrary up to 11.22.x Configuration defaultSanitizer incomplete blacklist

Summaryinfo

A vulnerability classified as critical was found in spatie laravel-medialibrary up to 11.22.x. Affected is the function FileAdder::defaultSanitizer of the component Configuration Handler. Such manipulation leads to incomplete blacklist. This vulnerability is listed as CVE-2026-48557. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in spatie laravel-medialibrary up to 11.22.x. It has been rated as critical. Affected by this issue is the function FileAdder::defaultSanitizer of the component Configuration Handler. The manipulation with an unknown input leads to a incomplete blacklist vulnerability. Using CWE to declare the problem leads to CWE-184. The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Spatie Laravel Media Library before version 11.23.0 contains a file upload restriction bypass in FileAdder::defaultSanitizer(). The sanitizer checks only the final filename suffix, allowing double-extension filenames such as shell.php.jpg to bypass the blocklist, with pathinfo() preserving inner .php stems in saved filenames. The blocklist also omits executable extensions including .php6, .shtml, and .htaccess. The double-extension bypass requires a legacy Apache AddHandler configuration to achieve PHP execution; the incomplete blocklist bypass does not.

The weakness was presented by Xurshidbek Sobirjonov. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-48557 since 05/21/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1562.006.

Upgrading to version 11.23.0 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 608ea03703d3887c46434f5dda6af56de6346aba is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-33439). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Software Library

Vendor

• spatie

Name

• laravel-medialibrary

Version

• 11.0
• 11.1
• 11.2
• 11.3
• 11.4
• 11.5
• 11.6
• 11.7
• 11.8
• 11.9
• 11.10
• 11.11
• 11.12
• 11.13
• 11.14
• 11.15
• 11.16
• 11.17
• 11.18
• 11.19
• 11.20
• 11.21
• 11.22

License

• open-source

Website

• Product: https://github.com/spatie/laravel-medialibrary/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion