CVE-2026-49970

Laravel-Mediable < 7.0.0 Path Traversal via File::sanitizePath()

Published Jul 13, 2026 CVSS 4.0 · 8.7 High EPSS 1.0% KEV · Not listed

Description

Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath() function that allows attackers to write uploaded files to arbitrary locations by controlling the directory argument passed to MediaUploader::toDestination(). Attackers can exploit the permissive character-class regex that allows both dot and slash characters combined with an ineffective trailing trim() call to bypass sanitization and upload files to sensitive locations such as the document root, environment configuration files, or application configuration directories, enabling remote code execution.

Analysis

Technical impact

Laravel‑Mediable prior to version 7.0.0 contains a path traversal flaw in the File::sanitizePath() method that fails to strip dot and slash characters from the supplied directory path. When an attacker supplies a crafted directory argument to MediaUploader::toDestination() and uploads a file, the sanitized path is bypassed, enabling the file to be written to any directory within the web root or configuration tree. This arbitrary file write permits an attacker to modify critical files such as environment configuration or application configuration files, leading to the ability to execute code on the server and compromise confidentiality, integrity, and availability.

Affected Systems

The vulnerability affects all installations of the plank:laravel-mediable package that are older than version 7.0.0. No other vendors or product versions are listed as impacted.

Risk and Exploitability

The CVSS score of 8.7 classifies this as a High severity vulnerability. The EPSS score is reported as less than 1 %, suggesting a low likelihood of current exploitation. The issue is not listed in the CISA KEV catalog. Attackers can exploit the flaw via a web request or API call that includes a specially crafted directory parameter to MediaUploader::toDestination(); the application must accept the upload request for exploitation to succeed.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

plank

laravel-mediable

affected

Version	Status	Constraints
`0`	affected	< 7.0.0

No data.

Vendor Product Versions

Plank

Laravel-mediable

Version	Status	Scheme	Platform
`[0,7.0.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Laravel‑Mediable to version 7.0.0 or later to remove the insecure sanitizePath logic.
Limit the directory argument used by MediaUploader::toDestination() to a predefined safe uploads directory to prevent traversal.
Enforce strict filesystem permissions on the upload directory so that only the application process can write files, and avoid giving write permissions to directories containing critical configuration or public files.

Generated by OpenCVE AI on July 31, 2026 at 11:26 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-xv8g-76mx-2rxc	Laravel-Mediable: path traversal vulnerability in the File::sanitizePath()

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 1.0% (1.026% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/plank/laravel-mediable/commit/6d1e7fb39922fdfb3b2d120e13f4eb2e653ae082
https://github.com/plank/laravel-mediable/releases/tag/7.0.0
https://www.vulncheck.com/advisories/laravel-mediable-path-traversal-via-file-sanitizepath

History

Jul 14, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jul 13, 2026 7:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Plank Plank laravel-mediable
Vendors & Products		Plank Plank laravel-mediable

Jul 13, 2026 6:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath() function that allows attackers to write uploaded files to arbitrary locations by controlling the directory argument passed to MediaUploader::toDestination(). Attackers can exploit the permissive character-class regex that allows both dot and slash characters combined with an ineffective trailing trim() call to bypass sanitization and upload files to sensitive locations such as the document root, environment configuration files, or application configuration directories, enabling remote code execution.
Title		Laravel-Mediable < 7.0.0 Path Traversal via File::sanitizePath()
Weaknesses		CWE-22
References		https://github.com/plank/laravel-mediable/commit/6d1e7fb39922fdfb3b2d120e13f4eb2e653ae082 https://github.com/plank/laravel-mediable/releases/tag/7.0.0 https://www.vulncheck.com/advisories/laravel-mediable-path-traversal-via-file-sanitizepath
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`