Threat Intelligence Database

Laravel-Mediable versions prior to 7.0.0 contain a file upload vulnerability that allows unauthenticated attackers to upload files with double extensions (e.g., shell.php.jpg) that bypass validation checks. Due to the way the filename is processed, the inner .php extension is preserved, which can lead to remote code execution on misconfigured Apache or nginx servers that execute files containing .php in their names. This vulnerability has a high severity rating and a CVSS score of 7.7.

Laravel-Mediable versions prior to 7.0.0 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows authenticated or anonymous users to upload SVG files with embedded malicious JavaScript, which executes when the file is viewed or previewed. The vulnerability arises from improper sanitization of SVG inputs, enabling persistent XSS attacks that can lead to session cookie theft, CSRF token capture, and potential account takeover.

Laravel-Mediable versions before 7.0.0 contain a path traversal vulnerability in the File::sanitizePath() function. This flaw allows attackers to manipulate the directory argument in MediaUploader::toDestination() to write uploaded files to arbitrary locations. The vulnerability arises from a permissive regex and ineffective sanitization, enabling uploads to sensitive directories such as the document root or configuration files, potentially leading to remote code execution.

Laravel-Mediable versions before 7.0.0 contain a server-side request forgery (SSRF) vulnerability. This flaw allows remote attackers to make arbitrary HTTP requests from the server by providing unvalidated URLs to endpoints using MediaUploader::fromSource(). Exploitation can target internal network addresses, loopback interfaces, cloud metadata services, or local file URIs, potentially exposing sensitive internal resources and cloud credentials. The vulnerability has a medium severity rating with a CVSS score of 5.3. No official patch or remediation guidance is currently available from the vendor.