Vulnerability · Published Jul 13, 2026 · Assigned by VulnCheck
CVE-2026-49970Laravel-Mediable < 7.0.0 Path Traversal via File::sanitizePath()
High 8.8
In plain English
A high-severity path traversal in laravel-mediable from plank. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath() function that allows attackers to write uploaded files to arbitrary locations by controlling the directory argument passed to MediaUploader::toDestination(). Attackers can exploit the permissive character-class regex that allows both dot and slash characters combined with an ineffective trailing trim() call to bypass sanitization and upload files to sensitive locations such as the document root, environment configuration files, or application configuration directories, enabling remote code execution.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | plank/laravel-mediable | 7.0.0 | GHSA-xv8g-76mx-2rxc |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| plank | laravel-mediable | 0 – before 7.0.0 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- laravel-mediable 7.0.0 Release Notes release-notes, patch
- Patch Commit patch
- https://www.vulncheck.com/advisories/laravel-mediable-path-traversal-via-file-sanitizepath third-party-advisory