Spatie Laravel Media Library versions prior to 11.23.0 contain a server‑side request forgery (SSRF) flaw that allows remote attackers to cause the server to issue arbitrary outbound HTTP requests by passing user‑controlled URLs to the addMediaFromUrl() method. The advisory does not detail additional impacts beyond the SSRF capability. The vulnerability is listed as CWE‑918.

The affected product is spatie/laravel-medialibrary in Laravel applications where the version is older than 11.23.0. Any deployment that uses the addMediaFromUrl() call in InteractsWithMedia.php without proper URL validation is at risk. No additional sub‑version detail was provided by the CNA.

With a CVSS score of 5.3 the severity is moderate; the EPSS score is unknown and the flaw is not listed in CISA’s KEV catalog, indicating no large‑scale exploits have been documented yet. Based on the description, it is inferred that the vulnerability could be exercised by supplying a malicious URL to the addMediaFromUrl() method via an externally accessible endpoint, causing the application server to make the outbound request. The advisory does not specify prerequisites for exploitation, but the presence of a public method suggests that the flaw could be accessible from the web.