Arbitrary File Upload Vulnerability in plank/laravel-mediable Affects Web Applications

CVE-2026-4809

What is CVE-2026-4809?

The plank/laravel-mediable package, up to version 6.4.0, is susceptible to an arbitrary file upload vulnerability. This occurs when an application accepts or prioritizes a client-supplied MIME type during file uploads, enabling a remote attacker to submit a file disguised as a benign image while actually containing executable PHP code. If the compromised file is uploaded and stored in an executable directory accessible from the web, it can lead to remote code execution. At present, no patches are available and efforts for coordinated disclosure have not been acknowledged by the vendor.

References