The vulnerability originates in Laravel‑Mediable 7.0.0 through 7.0.1, where the .pht extension was mistakenly omitted from the forbidden extensions list. Because the library does not block .pht uploads, an attacker can upload a file named with that extension, which travels through the upload pipeline unchanged. On Debian/Ubuntu systems running Apache, the default FilesMatch directive causes .pht files to be interpreted as PHP, allowing the attacker to execute arbitrary code with the web‑server process's privileges. This grants full remote code execution on the host system, providing an attacker full control over the affected web application and underlying server.

The affected products are the Laravel‑Mediable component developed by Plank, specifically versions 7.0.0 through 7.0.1. These versions are commonly integrated into Laravel applications that handle media uploads. Any deployment that relies on an unchanged 7.0.0 to 7.0.1 release without the patch that adds .pht to the forbidden list is susceptible.

The CVSS base score of 9.3 describes a critical remote code execution risk. Although the EPSS value is not available, the absence of a KEV listing suggests no documented active exploitation yet, yet the vulnerability remains high risk because any upload functionality can be abused. The attack vector is likely over the web via an authenticated or unauthenticated upload feature; once the .pht file is stored, a subsequent request to the file will trigger PHP execution through Apache’s default configuration.