Unsafe Client MIME Type Handling Can Enable Arbitrary File Upload in plank/laravel-mediable

The primary impact of CVE-2026-4809 is the potential for remote code execution (RCE). An attacker can exploit this vulnerability by crafting a malicious PHP file, disguising it with a benign image MIME type (e.g., image/jpeg), and uploading it through the laravel-mediable package. If the application trusts the client-supplied MIME type and stores the uploaded file in a web-accessible directory with PHP execution enabled, the attacker can execute arbitrary code on the server. This could lead to complete system compromise, data theft, or denial of service. The blast radius extends to any sensitive data or functionality accessible by the web server, making this a high-severity risk.

Applications built with Laravel that utilize the laravel-mediable package for file uploads are at risk. This includes projects that rely on client-supplied MIME types for file validation without robust server-side verification. Shared hosting environments where users have control over file uploads are particularly vulnerable.

• laravel: Inspect file upload handling code for reliance on client-supplied MIME types. Check for files with PHP extensions in web-accessible directories. Use find /var/www/laravel -name '*.php' to identify potential targets. • generic web: Monitor web server access logs for unusual file uploads, particularly those with image extensions but potentially malicious content. Look for requests containing Content-Type: image/* followed by PHP file access. • generic web: Use a WAF to block uploads of files with potentially dangerous extensions (e.g., .php, .phtml, .php3) regardless of the declared MIME type.

1. 2026-03-26Disclosure

   disclosure

1. Reserviert2026-03-25
2. Veröffentlicht2026-03-26
3. EPSS aktualisiert2026-04-02

Due to the absence of a patch, immediate mitigation is crucial. The primary defense is to implement strict MIME type validation on the server-side, independently verifying the file type regardless of the client-supplied header. Configure the web server to disallow PHP execution in the upload directory. Consider using a WAF (Web Application Firewall) to filter potentially malicious file uploads. Implement robust file storage practices, ensuring uploaded files are stored outside of the web root and are not executable. Regularly scan the application for misconfigurations and vulnerabilities. After implementing these mitigations, verify file upload functionality to ensure legitimate uploads are not blocked.