Home

Description

plank/laravel-mediable through version 6.4.0 can allow upload of a dangerous file type when an application using the package accepts or prefers a client-supplied MIME type during file upload handling. In that configuration, a remote attacker can submit a file containing executable PHP code while declaring a benign image MIME type, resulting in arbitrary file upload. If the uploaded file is stored in a web-accessible and executable location, this may lead to remote code execution. At the time of publication, no patch was available and the vendor had not responded to coordinated disclosure attempts.

PUBLISHED Reserved 2026-03-25 | Published 2026-03-26 | Updated 2026-03-26 | Assigner TuranSec




CRITICAL: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10.0AV:N/AC:L/Au:N/C:C/I:C/A:C

Problem types

CWE-434 Unrestricted Upload of File with Dangerous Type

Product status

Default status
unaffected

<= 6.4.0
affected

Credits

Sobirjonov Xurshidbek finder

References

github.com/plank/laravel-mediable (Project repository)

github.com/plank/laravel-mediable/releases/tag/6.4.0 (Release 6.4.0)

github.com/plank/laravel-mediable (Upstream project homepage)

cve.org (CVE-2026-4809)

nvd.nist.gov (CVE-2026-4809)

Download JSON