The vulnerability resides in Spatie Laravel Media Library older than 11.23.0, where the default sanitizer in FileAdder::defaultSanitizer() only checks the last suffix of a filename. Attackers can craft double‑extension names such as shell.php.jpg that bypass the blocklist. The sanitizer also fails to block several executable extensions like .php6, .shtml, and .htaccess. If the web server uses a legacy Apache AddHandler mapping that treats the outer extension as executable, the bypass allows arbitrary PHP execution. Even without that configuration, the flaw still allows an attacker to store files with dangerous extensions on the filesystem.

All installations of the Spatie Laravel Media Library package with a version earlier than 11.23.0 are impacted. The vulnerability is tied to the PHP library provided by spatie, not to any specific Laravel framework version.

The CVSS score of 8.7 indicates high severity. The exploit requires an attacker to upload a crafted file, and success depends on server configuration – the risk is significant on legacy Apache setups that map image extensions to the PHP handler. The EPSS score is not available, and the vulnerability is not listed in KEV, suggesting it has not yet been widely exploited in the wild, but the potential for critical impact remains.