CVE-2026-49972 Details

A remote code execution vulnerability exists in Laravel-Mediable versions prior to 7.0.0. This issue arises from a file upload vulnerability that allows unauthenticated attackers to execute arbitrary code by uploading a file with a PHP extension hidden within a double extension, such as shell.php.jpg. The vulnerability exploits the PATHINFO_FILENAME extraction, which retains the inner .php extension in the base name. On misconfigured Apache or Nginx servers that execute filenames containing .php as PHP, the uploaded file is treated as executable code. All validation checks for MIME type, extension, and aggregate type are bypassed due to the outer .jpg extension.

Users are advised to upgrade to Laravel-Mediable version 7.0.0 or later, where this vulnerability has been fixed.