CVE-2026-4809: plank/laravel-mediable Unrestricted File Upload via Client-Supplied MIME Type
CVE-2026-4809 affects plank/laravel-mediable through version 6.4.0. In applications that accept or prefer a client-supplied MIME type, a remote attacker may upload a file containing executable PHP code while declaring a benign image type. The CNA scores it 9.8 under CVSS 3.1, but the record lists no confirmed exploitation and no KEV entry.
Overview
CVE-2026-4809 is a file upload weakness (CWE-434, Unrestricted Upload of File with Dangerous Type) in plank/laravel-mediable, a package used in Laravel applications to manage media files. The record states that the package can allow a dangerous file type to be uploaded when the surrounding application trusts a MIME type supplied by the client. The issue is conditional on that application configuration.
Impact
The record describes arbitrary file upload. If an uploaded file containing PHP code is stored in a location reachable and executable by the web server, the outcome could include code execution on the server. The CNA assigns a CVSS 3.1 base score of 9.8 (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a CVSS 4.0 score of 9.3. These scores describe the vulnerability as reported; actual risk depends on each deployment.
Affected products and versions
- Product: plank/laravel-mediable.
- Reported as affected: through version 6.4.0.
- The structured affected and fixed fields in the record are empty. The exact affected range, and whether a fixed release exists, cannot be confirmed from the record.
- Exploitability requires an application that accepts or prefers the client-supplied MIME type.
Exploitation status
The record marks this CVE as not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability is 0.01139 with a percentile of 0.65766, which estimates likelihood of exploitation but is not evidence of observed attacks.
Remediation and mitigation
- Check whether the installed version is 6.4.0 or earlier and review the project release page for a newer version that addresses this issue.
- Do not rely on the MIME type sent by the client for security decisions. Determine file type on the server from file content and restrict accepted extensions to what the application needs.
- Store uploads outside the web root or in locations where the web server does not execute scripts.
- Apply least privilege to the upload directory and restrict write access.
Detection guidance
- Review upload endpoints for files whose declared type differs from their actual content.
- Look for newly created script-type files in upload and media directories.
- Monitor web server logs for unexpected requests to uploaded files in media paths.
Limitations of the available information
The record does not list affected or fixed versions beyond the description, does not describe the specific vulnerable code path, and does not provide a vendor advisory text. Whether a patched release exists is unknown. The EPSS date in the record is not used to draw conclusions about timing. Administrators should confirm details against the project repository and release notes.
Frequently asked questions
Does this CVE affect every application using plank/laravel-mediable?
No. The record says the issue applies when the application accepts or prefers a client-supplied MIME type during upload handling. Applications that validate file content on the server are described as outside that condition, though the record does not detail all configurations.
Is this CVE known to be exploited in the wild?
The record lists it as not in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. The EPSS value estimates likelihood but does not confirm attacks.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.