CVE-2026-48555 is a server-side request forgery vulnerability in the Spatie Laravel Media Library before version 11.23.0. The issue arises from the addMediaFromUrl() method in InteractsWithMedia.php, which accepts user-controlled URLs without sufficient validation, enabling attackers to cause the server to issue arbitrary outbound HTTP requests. This can potentially be leveraged to access internal resources or perform other unintended network interactions. The vulnerability has a CVSS v4.0 base score of 5.3, indicating medium severity. As of the provided data, no official fix or patch has been confirmed by the vendor.

The vulnerability allows remote attackers to cause the affected server to make arbitrary outbound HTTP requests. This can lead to unauthorized access to internal network resources or services that are not directly accessible externally. The impact is limited to the ability to induce the server to perform these requests, with no direct indication of further compromise or data leakage from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid passing untrusted user input directly to the addMediaFromUrl() method. Implement input validation or filtering to restrict URLs to trusted domains if possible.