Vulnerability · Published Jul 13, 2026 · Assigned by VulnCheck

CVE-2026-49969Laravel-Mediable < 7.0.0 SSRF via RemoteUrlAdapter URL Handling

High 7.4

In plain English

A high-severity server-side request forgery in laravel-mediable from plank. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.4%top 63.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that allows remote attackers to issue arbitrary HTTP requests from the server by supplying unvalidated caller-controlled URLs to endpoints backed by MediaUploader::fromSource(). Attackers can craft URLs targeting RFC-1918 addresses, loopback interfaces, cloud metadata endpoints, or file:// URIs through RemoteUrlAdapter to reach internal infrastructure, retrieve sensitive files, and exfiltrate cloud credentials such as IAM tokens from instance metadata services.

Affected products (as reported)

Vendor	Product	Versions
plank	laravel-mediable	0 – before 7.0.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

References

laravel-mediable 7.0.0 Release Notes release-notes, patch
Patch Commit patch
https://www.vulncheck.com/advisories/laravel-mediable-ssrf-via-remoteurladapter-url-handling third-party-advisory