CVE-2026-49970 is a path traversal vulnerability in the plank laravel-mediable package prior to version 7.0.0. The issue exists in the File::sanitizePath() function, which inadequately sanitizes the directory argument passed to MediaUploader::toDestination(). The sanitization uses a permissive character-class regex that allows dot and slash characters, combined with an ineffective trailing trim() call, permitting attackers to bypass restrictions and upload files outside intended directories. This can lead to arbitrary file writes in sensitive locations, including the document root and configuration directories, enabling remote code execution.

Exploitation of this vulnerability allows an attacker with limited privileges to write files to arbitrary locations on the server. This can result in overwriting critical files such as environment configuration or application configuration files, potentially leading to remote code execution. The CVSS 4.0 base score is 8.7 (high severity), reflecting the network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using vulnerable versions of laravel-mediable. Restrict file upload permissions and validate or sanitize input controlling upload destinations carefully to mitigate risk.