CVE-2026-49972

Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading a file with an embedded PHP extension disguised within a double extension such as shell.php.jpg. The PATHINFO_FILENAME extraction preserves the inner .php extension in the base name, and on misconfigured Apache or nginx servers that execute any filename containing .php as PHP, the stored file is interpreted as executable code while all MIME type, extension, and aggregate type validation checks pass due to the outer .jpg extension.

CVSS 4.0

7.7CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

1.1% chance of exploitation in the next 30 days; higher than 64% of CVEs (scores of 2026-10-25)

CWE

CWE-434

Published

2026-07-13

Modified

2026-10-24

Record from

the NVD, synced 2026-10-25

References

• https://github.com/plank/laravel-mediable/commit/49e3583bed13423611b3391f89e6b002571eed73
• https://github.com/plank/laravel-mediable/releases/tag/7.0.0
• https://www.vulncheck.com/advisories/laravel-mediable-file-upload-rce-via-extension-bypass

Check your stackJSON