plank laravel-mediable up to 6.x shell.php.jpg unrestricted upload

Summaryinfo

A vulnerability has been found in plank laravel-mediable up to 6.x and classified as critical. The impacted element is an unknown function of the file shell.php.jpg. The manipulation leads to unrestricted upload. This vulnerability is listed as CVE-2026-49972. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in plank laravel-mediable up to 6.x. It has been rated as critical. This issue affects an unknown part of the file shell.php.jpg. The manipulation with an unknown input leads to a unrestricted upload vulnerability. Using CWE to declare the problem leads to CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading a file with an embedded PHP extension disguised within a double extension such as shell.php.jpg. The PATHINFO_FILENAME extraction preserves the inner .php extension in the base name, and on misconfigured Apache or nginx servers that execute any filename containing .php as PHP, the stored file is interpreted as executable code while all MIME type, extension, and aggregate type validation checks pass due to the outer .jpg extension.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-49972 since 06/02/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1608.002 according to MITRE ATT&CK.

Upgrading to version 7.0.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• plank

Name

• laravel-mediable

Version

• 6.x

Website

• Product: https://github.com/plank/laravel-mediable/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion