CVE-2026-4809 Details
Description
plank/laravel-mediable through version 6.4.0 can allow upload of a dangerous file type when an application using the package accepts or prefers a client-supplied MIME type during file upload handling. In that configuration, a remote attacker can submit a file containing executable PHP code while declaring a benign image MIME type, resulting in arbitrary file upload.
An arbitrary file upload vulnerability has been identified in Plank Laravel-Mediable versions through 6.4.0. The issue arises when an application using this package accepts or prioritizes client-supplied MIME types during file uploads. In such cases, a remote attacker could upload a file containing executable PHP code while masquerading it as a harmless image MIME type. If the uploaded file is stored in a web-accessible and executable directory, this could lead to remote code execution.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 26, 2026CISA-ADP
Assessed Mar 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/plank/laravel-mediable | TuranSec | Vendor |
| https://github.com/plank/laravel-mediable/releases/tag/6.4.0 | TuranSec | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | TuranSec |
Affected Products
| Product | Versions |
|---|---|
| plank/laravel-mediable | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | TuranSec |
| Jun 17, 2026 | CVE Modified | TuranSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 26, 2026 | New CVE Received | TuranSec |