Laravel Medialibrary
Approved changes feed: RSS · Atom
cpe:2.3:a:spatie:laravel-medialibrary:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Spatie (9f5c1266-2f84-5f99-a436-b159ab90a1ee) |
|---|---|
| Product | Laravel Medialibrary (cae3693c-996a-5889-bf1d-59bb961e9024) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-48557 |
vulnerable | 2026-06-08 08:05:12.293749 |
Spatie Laravel Media Library < 11.23.0 File Upload Restriction Bypass via FileAdder.php
HIGH (8.8)
Spatie Laravel Media Library before version 11.23.0 contains a file upload restriction bypass in FileAdder::defaultSanitizer(). The sanitizer checks only the final filename suffix, allowing double-extension filenames such as shell.php.jpg to bypass the blocklist, with pathinfo() preserving inner .php stems in saved filenames. The blocklist also omits executable extensions including .php6, .shtml, and .htaccess. The double-extension bypass requires a legacy Apache AddHandler configuration to achieve PHP execution; the incomplete blocklist bypass does not.
Published: 2026-05-29T19:49:15.604Z
Updated: 2026-07-28T01:49:32.071Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-48555 |
vulnerable | 2026-06-08 08:05:12.293478 |
Spatie Laravel Media Library < 11.23.0 SSRF via addMediaFromUrl()
HIGH (7.4)
Spatie Laravel Media Library before version 11.23.0 contains a server-side request forgery vulnerability that allows remote attackers to cause the server to issue arbitrary outbound HTTP requests by passing user-controlled URLs to the addMediaFromUrl() method in InteractsWithMedia.php.
Published: 2026-05-29T18:30:27.182Z
Updated: 2026-07-28T01:49:31.399Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.