CVE-2026-48557 Details

A file upload restriction bypass vulnerability has been identified in Spatie Laravel Media Library versions prior to 11.23.0. The issue resides in the default file name sanitizer, which only checks the final file extension. This oversight allows double-extension files, such as 'shell.php.jpg', to circumvent the blocklist, as 'pathinfo()' retains the inner '.php' portion in the saved file name. Additionally, the blocklist fails to include certain executable extensions like '.php6', '.shtml', and '.htaccess'. While the double-extension bypass can be exploited to execute PHP files under a legacy Apache AddHandler configuration, the general blocklist oversight does not require such conditions.

Users can update to Spatie Laravel Media Library version 11.23.0 or later, where this vulnerability has been addressed. For those unable to update, the blocked extensions can be configured in 'media-library.php'.