Vulnerability · Published May 29, 2026 · Assigned by VulnCheck

CVE-2026-48557Spatie Laravel Media Library < 11.23.0 File Upload Restriction Bypass via FileAdder.php

High 8.8

In plain English

A high-severity security flaw in laravel-medialibrary from spatie. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.4%top 61.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Spatie Laravel Media Library before version 11.23.0 contains a file upload restriction bypass in FileAdder::defaultSanitizer(). The sanitizer checks only the final filename suffix, allowing double-extension filenames such as shell.php.jpg to bypass the blocklist, with pathinfo() preserving inner .php stems in saved filenames. The blocklist also omits executable extensions including .php6, .shtml, and .htaccess. The double-extension bypass requires a legacy Apache AddHandler configuration to achieve PHP execution; the incomplete blocklist bypass does not.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	spatie/laravel-medialibrary	11.23.0	GHSA-3ggm-c5m7-hfv5

Affected products (as reported)

Vendor	Product	Versions
spatie	laravel-medialibrary	0 – before 11.23.0

Weakness: CWE-184 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/spatie/laravel-medialibrary/releases/tag/11.23.0 release-notes
https://github.com/spatie/laravel-medialibrary/pull/3939 issue-tracking
https://github.com/spatie/laravel-medialibrary/commit/608ea03703d3887c46434f5dda6af56de6346aba patch
https://www.vulncheck.com/advisories/spatie-laravel-media-library-file-upload-restriction-bypass-via-fileadder-php third-party-advisory