CVE-2026-4809 | BDVDB-2026-323101 Detail
planklaravel-mediable
Description#
plank/laravel-mediable through version 6.4.0 can allow upload of a dangerous file type when an application using the package accepts or prefers a client-supplied MIME type during file upload handling. In that configuration, a remote attacker can submit a file containing executable PHP code while declaring a benign image MIME type, resulting in arbitrary file upload.
Impact#
A remote attacker can upload a file containing executable PHP code while supplying a benign image MIME type. If the consuming application accepts the client-controlled MIME type and stores uploaded files in a web-accessible executable location, this can result in arbitrary file upload and remote code execution.
Weaknesses#
- CWE-434 Unrestricted Upload of File with Dangerous Type
References#
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.