CVE-2026-4809 laravel-mediable 任意文件上传漏洞

CVE-2026-4809 在 plank/laravel-mediable (版本低于 6.4.0) 中允许上传危险文件。如果使用该包的应用程序在文件上传处理过程中信任客户端提供的 MIME 类型，则远程攻击者可以将恶意 PHP 文件伪装成无害的图像文件并上传。这通过声明图像 MIME 类型（例如 'image/jpeg'）同时上传可执行的 PHP 代码来实现。如果文件存储在 Web 可访问且可执行的位置，则可能导致远程代码执行，从而危及 Laravel 应用程序的安全性。

Applications built with Laravel that utilize the laravel-mediable package for file uploads are at risk. This includes projects that rely on client-supplied MIME types for file validation without robust server-side verification. Shared hosting environments where users have control over file uploads are particularly vulnerable.

• laravel: Inspect file upload handling code for reliance on client-supplied MIME types. Check for files with PHP extensions in web-accessible directories. Use find /var/www/laravel -name '*.php' to identify potential targets. • generic web: Monitor web server access logs for unusual file uploads, particularly those with image extensions but potentially malicious content. Look for requests containing Content-Type: image/* followed by PHP file access. • generic web: Use a WAF to block uploads of files with potentially dangerous extensions (e.g., .php, .phtml, .php3) regardless of the declared MIME type.

1. 2026-03-26Disclosure

   disclosure

1. 已保留2026-03-25
2. 发布日期2026-03-26
3. EPSS 更新日期2026-04-02

建议的解决方案是将 plank/laravel-mediable 更新到修复版本（高于 6.4.0）。此外，在服务器端实施强大的文件类型验证至关重要，无论客户端提供的 MIME 类型如何。这包括验证文件扩展名，并理想情况下分析文件内容以确认其与声明的 MIME 类型相符。在文件存储目录中禁用 PHP 执行是另一个重要的安全措施。最后，审查和加强应用程序的安全策略以防止未经授权的文件上传至关重要。