CVE-2026-49972 affects Laravel-Mediable before version 7.0.0. The vulnerability arises from improper handling of uploaded filenames with double extensions, where the inner .php extension remains in the base filename after PATHINFO_FILENAME extraction. This allows an attacker to upload a file such as shell.php.jpg that passes MIME type and extension validation due to the outer .jpg extension. On web servers configured to execute any file containing .php in its name as PHP code, the uploaded file can be executed, enabling remote code execution by unauthenticated attackers.

Successful exploitation can lead to remote code execution on affected servers, allowing attackers to run arbitrary PHP code. This can compromise the confidentiality, integrity, and availability of the affected system. The vulnerability is exploitable without authentication and requires the server to be misconfigured to execute PHP code in files with .php anywhere in the filename.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and harden server configurations to ensure that files with double extensions containing .php are not executed as PHP code. Implement strict validation and sanitization of uploaded filenames and extensions. Consider disabling execution of PHP code in upload directories or using separate storage mechanisms that do not allow execution.