CVE-2026-48557
Spatie Laravel Media Library < 11.23.0 File Upload Restriction Bypass via FileAdder.php
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
Spatie Laravel Media Library before version 11.23.0 contains a file upload restriction bypass in FileAdder::defaultSanitizer(). The sanitizer checks only the final filename suffix, allowing double-extension filenames such as shell.php.jpg to bypass the blocklist, with pathinfo() preserving inner .php stems in saved filenames. The blocklist also omits executable extensions including .php6, .shtml, and .htaccess. The double-extension bypass requires a legacy Apache AddHandler configuration to achieve PHP execution; the incomplete blocklist bypass does not.
| CWE | CWE-184 |
| Vendor | spatie |
| Product | laravel-medialibrary |
| Published | May 29, 2026 |
| Last Updated | May 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for spatie laravel-medialibrary
Be the first to know when new high vulnerabilities affecting spatie laravel-medialibrary are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
spatie / laravel-medialibrary
0 < 11.23.0
References
github.com: https://github.com/spatie/laravel-medialibrary/releases/tag/11.23.0 github.com: https://github.com/spatie/laravel-medialibrary/pull/3939 github.com: https://github.com/spatie/laravel-medialibrary/commit/608ea03703d3887c46434f5dda6af56de6346aba vulncheck.com: https://www.vulncheck.com/advisories/spatie-laravel-media-library-file-upload-restriction-bypass-via-fileadder-php
Credits
Xurshidbek Sobirjonov VulnCheck