GitHub Advisoryadvisory · Packagist
GHSA-3ggm-c5m7-hfv5 Spatie Laravel Media Library contains a file upload restriction bypass
HIGH
Official page ↗
- Aliases
- CVE-2026-48557
- Ecosystem
- Packagist
- Packages
- spatie/laravel-medialibrary
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-184
- Reviewed
- 2026-07-02
Affected packages
• Packagist spatie/laravel-medialibrary: < 11.23.0 → fixed in 11.23.0
Description
Spatie Laravel Media Library before version 11.23.0 contains a file upload restriction bypass in FileAdder::defaultSanitizer(). The sanitizer checks only the final filename suffix, allowing double-extension filenames such as shell.php.jpg to bypass the blocklist, with pathinfo() preserving inner .php stems in saved filenames. The blocklist also omits executable extensions including .php6, .shtml, and .htaccess. The double-extension bypass requires a legacy Apache AddHandler configuration to achieve PHP execution; the incomplete blocklist bypass does not.
Related
Alias · CVE (1)
- CVE-2026-48557 Spatie Laravel Media Library before version 11.23.0 contains a file upload restriction bypass in FileAdder::defaultSanitizer(). vulnerability
Weakness · CWE (1)
- CWE-184 Incomplete List of Disallowed Inputs weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-48557 advisory
- https://github.com/spatie/laravel-medialibrary/pull/3939 web
- https://github.com/spatie/laravel-medialibrary/commit/608ea03703d3887c46434f5dda6af56de6346aba web
- https://github.com/spatie/laravel-medialibrary package
- https://github.com/spatie/laravel-medialibrary/releases/tag/11.23.0 web
- https://www.vulncheck.com/advisories/spatie-laravel-media-library-file-upload-restriction-bypass-via-fileadder-php web