Unrestricted file upload affecting plank/laravel-mediable
A critical vulnerability affecting plank/laravel-mediable would allow an unauthenticated attacker to remotely execute arbitrary code on affected systems.
Description
Technical context and vulnerability details
plank/laravel-mediable is a library dedicated to the Laravel framework, designed to simplify and structure the association of files (images, videos or documents) with different elements of a web application. This package is affected by a critical vulnerability labeled CVE-2026-4809 resulting from insufficient validation of file types during the upload process. Exploitation of this vulnerability could allow an unauthenticated attacker to upload arbitrary files that could lead to remote code execution on affected systems. It is classified critical with a severity score of 9.8 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Arbitrary Code Execution;
- Violation of data integrity and availability;
- Compromise of system integrity;
Affected systems
Products, components and targeted versions
- All versions of plank/laravel-mediable up to and including version 6.4.0;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Implement strict server-side validation to check files based on their actual content and extension, instead of the client-provided MIME type;
- Ensure that the storage directories of uploaded files do not have execution rights at the web server level (e.g. via .htaccess or Nginx configuration);
- Apply security patches as soon as the publisher has made a corrected version available;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.