CVE-2026-49970: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in plank laravel-mediable
Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath() function that allows attackers to write uploaded files to arbitrary locations by controlling the directory argument passed to MediaUploader::toDestination(). Attackers can exploit the permissive character-class regex that allows both dot and slash characters combined with an ineffective trailing trim() call to bypass sanitization and upload files to sensitive locations such as the document root, environment configuration files, or application configuration directories, enabling remote code execution.
AI Analysis
Technical Summary
CVE-2026-49970 is a path traversal vulnerability in plank's laravel-mediable package before version 7.0.0. The vulnerability arises from the File::sanitizePath() function, which uses a permissive regex allowing dot and slash characters combined with an ineffective trailing trim() call. This allows attackers to control the directory argument passed to MediaUploader::toDestination(), enabling them to write uploaded files outside intended directories. Successful exploitation can lead to placing malicious files in sensitive locations, including the document root and configuration files, which may result in remote code execution.
Potential Impact
Attackers can upload files to arbitrary and sensitive locations within the affected system, such as the web document root or configuration directories. This can lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected application and potentially the underlying system.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using versions prior to 7.0.0 in production environments or restrict file upload functionality to trusted users only. Monitor vendor channels for updates regarding an official patch or workaround.
CVE-2026-49970: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in plank laravel-mediable
Description
Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath() function that allows attackers to write uploaded files to arbitrary locations by controlling the directory argument passed to MediaUploader::toDestination(). Attackers can exploit the permissive character-class regex that allows both dot and slash characters combined with an ineffective trailing trim() call to bypass sanitization and upload files to sensitive locations such as the document root, environment configuration files, or application configuration directories, enabling remote code execution.
CVSS v4.0
Score 8.7high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-49970 is a path traversal vulnerability in plank's laravel-mediable package before version 7.0.0. The vulnerability arises from the File::sanitizePath() function, which uses a permissive regex allowing dot and slash characters combined with an ineffective trailing trim() call. This allows attackers to control the directory argument passed to MediaUploader::toDestination(), enabling them to write uploaded files outside intended directories. Successful exploitation can lead to placing malicious files in sensitive locations, including the document root and configuration files, which may result in remote code execution.
Potential Impact
Attackers can upload files to arbitrary and sensitive locations within the affected system, such as the web document root or configuration directories. This can lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected application and potentially the underlying system.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using versions prior to 7.0.0 in production environments or restrict file upload functionality to trusted users only. Monitor vendor channels for updates regarding an official patch or workaround.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-06-02T16:30:15.234Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a552f7368715ace43a5ecd9
Added to database: 07/13/2026, 18:33:23 UTC
Last enriched: 07/20/2026, 19:04:57 UTC
Last updated: 08/26/2026, 22:52:11 UTC
Views: 103
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.