Laravel-Mediable RCE Flaw (CVE-2026-49972) Lets Hackers Bypass File Upload Checks

A high-severity vulnerability in the popular Laravel-Mediable package could let unauthenticated attackers achieve full remote code execution simply by uploading a booby-trapped image file.

Tracked as CVE-2026-49972 and carrying a CVSS score of 7.7, the flaw affects all versions of Laravel-Mediable prior to 7.0.0 and stems from a classic double-extension bypass that has long haunted file upload handling.

Laravel-Mediable is a widely used package for handling media uploads in Laravel applications, managing everything from MIME-type validation to file storage. The vulnerability, tracked under CWE-434 (Unrestricted Upload of File with Dangerous Type), lies in how the package extracts filenames using PHP’s PATHINFO_FILENAME function.

Laravel-Mediable RCE Flaw

When a user uploads a file named something like shell.php.jpg, Laravel-Mediable’s validation logic checks the outer extension (.jpg) and MIME type, both of which pass every legitimate check.

However, PATHINFO_FILENAME extraction preserves the inner .php extension in the stored base filename rather than stripping it entirely.

On servers with misconfigured Apache or nginx setups specifically those that execute any file containing .php anywhere in its name, not just as the final extension the uploaded file gets interpreted and executed as PHP code.

This means an attacker with no authentication credentials whatsoever could upload a disguised web shell via a standard file-upload form, then trigger it by requesting the file directly, thereby gaining code execution on the underlying server.

The CVSS v4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H) tells a stark story: the attack is network-based, requires low complexity, needs no user interaction, and results in high impact to confidentiality, integrity, and availability.

The “AT:P” (attack requires some target-specific conditions) reflects the dependency on server misconfiguration, but given how common permissive .php execution rules remain in legacy Apache setups, this isn’t a theoretical edge case.

Remediation

The vulnerability was responsibly disclosed by researcher Xurshidbek Sobirjonov through VulnCheck. The maintainers at Plank addressed the issue in the 7.0.0 release, tightening filename sanitization to strip all embedded extensions rather than relying on outer-extension checks alone.

The patch commit shows the fix directly targets the extraction logic that previously trusted PATHINFO_FILENAME output without additional sanitization against nested dangerous extensions.

Upgrade Laravel-Mediable to version 7.0.0 or later immediately.
Audit web server configurations to ensure .php execution is scoped strictly to files ending in .php, not files merely containing the string.
Review upload directories for any suspicious double-extension files as a compromise-indicator check.
Implement defense-in-depth measures like disabling script execution in upload directories via .htaccess or nginx location blocks, regardless of application-layer fixes.

This vulnerability serves as a reminder that file upload validation can never rely on a single layer of defense. Extension checks, MIME validation, and server configuration must all align, because attackers only need one gap to exploit.