Laravel‑Mediable before version 7.0.0 contains a server‑side request forgery vulnerability (CWE‑918) that allows attackers to supply unvalidated URLs to the MediaUploader::fromSource() endpoint. The RemoteUrlAdapter used in that flow blindly fetches the specified URL, enabling the application to issue arbitrary HTTP requests to any address the server can reach. Attackers can target RFC‑1918 ranges, loopback interfaces, cloud metadata endpoints, or file:// URIs, thereby exposing internal resources, retrieving sensitive files, and extracting cloud credentials such services.

Any installation of the Laravel‑Mediable package from the plank vendor that is aged before version 7.0.0, package’s media handling functionality and have not upgraded past that major release.

The CVSS score of 5.3 indicates a moderate rating, yet the ability to coerce the server into making arbitrary requests allows an attacker to gather confidential data from internal systems or cloud services. The EPSS score is < 1%, indicating a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. vulnerable endpoint and let the server perform the request on the attacker’s behalf.