Technical impact
This vulnerability—an instance of CWE-434 (Unrestricted Upload of File with Dangerous Type)—allows an attacker to upload files that are stored with a double extension such as shell.php.jpg. The file name is processed in a way that preserves the inner .php extension, so a misconfigured Apache or nginx server that executes any filename containing ".php" will treat the file as PHP code. Because MIME, extension, and aggregate type checks are bypassed, the attacker can inject malicious PHP into the target site, leading to remote code execution.
Affected Systems
The Laravel-Mediable package developed by plank, versions before 7.0.0, is impacted. Any application using this library without upgrading to version 7.0.0 or later is vulnerable.
Risk and Exploitability
The CVSS base score of 7.7 indicates high severity, the EPSS score is < 1% (approximately 0.00777), showing a low but measurable probability of exploitation, and the vulnerability is not listed in the KEV catalog. An unauthenticated attacker can exploit the flaw by simply uploading a crafted file with a double extension to a misconfigured server that processes filenames containing ".php" as executable scripts, making the attack straightforward.
