Plank's laravel-mediable package permits a web application to accept client-supplied MIME types for file uploads. An attacker can submit a file containing executable PHP code while declaring the MIME type as a harmless image. Because the package trusts the client-provided MIME type, the file is stored on the server without proper validation. If the upload location is web‑accessible and executable, the attacker can achieve remote code execution, compromising server integrity, confidentiality, and availability. This reflects an unvalidated file upload weakness (CWE-434).

Any application using plank's laravel-mediable package up to and including version 6.4.0 is affected when configured to prefer or accept the client-supplied MIME type. As the package is widely used in Laravel-based CMS and e-commerce projects, the vulnerability spans a range of PHP web applications. No further constraints are specified, so the impact is relevant to any environment deploying the vulnerable library.

The CVSS score of 9.3 indicates a critical severity, confirming a high likelihood of successful exploitation. The EPSS score is not available, but the absence of a public patch and vendor response suggest that attackers could readily leverage this flaw. Because the vulnerability is triggered via a standard file upload form over HTTP, the attack vector is remote and does not require authentication. Potential consequences include arbitrary code execution on the host, which could lead to full system compromise. The vulnerability is not listed in CISA’s KEV catalog, yet it poses the same risks as other documented arbitrary upload exploits.