Laravel‑Mediable prior to version 7.0.0 contains a path traversal flaw in the File::sanitizePath() method that fails to strip dot and slash characters from the supplied directory path. When an attacker supplies a crafted directory argument to MediaUploader::toDestination() and uploads a file, the sanitized path is bypassed, enabling the file to be written to any directory within the web root or configuration tree. This arbitrary file write permits an attacker to modify critical files such as environment configuration or application configuration files, leading to the ability to execute code on the server and compromise confidentiality, integrity, and availability.

The vulnerability affects all installations of the plank:laravel-mediable package that are older than version 7.0.0. No other vendors or product versions are listed as impacted.

The CVSS score of 8.7 classifies this as a High severity vulnerability. The EPSS score is reported as less than 1 %, suggesting a low likelihood of current exploitation. The issue is not listed in the CISA KEV catalog. Attackers can exploit the flaw via a web request or API call that includes a specially crafted directory parameter to MediaUploader::toDestination(); the application must accept the upload request for exploitation to succeed.