Remote Code Execution Vulnerability in Laravel-Mediable by Plank
CVE-2026-93352
9.3CRITICAL
What is CVE-2026-93352?
Laravel-Mediable 7.0.0 prior to version 7.0.2 has a security flaw due to an incomplete patch from CVE-2026-49972. The vulnerability arises because the .pht file extension is not included in the forbidden_extensions blocklist within config/mediable.php. As a result, attackers can upload malicious .pht files that bypass validation checks in MediaUploader::verifyExtension() and File::sanitizeFileName(). This oversight allows the files to be stored on the server and executed as PHP scripts, potentially leading to unauthorized remote code execution with the server's privileges.
Affected Version(s)
laravel-mediable 7.0.0 < 7.0.2