Read the docs
TI-2026-35915 Aliases CVE-2026-48557GHSA-3ggm-c5m7-hfv5

Spatie Laravel Media Library < 11.23.0 File Upload Restriction Bypass via FileAdder.php

Priority MEDIUM 40CWE-184Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Spatie Laravel Media Library before version 11.23.0 contains a file upload restriction bypass in FileAdder::defaultSanitizer(). The sanitizer checks only the final filename suffix, allowing double-extension filenames such as shell.php.jpg to bypass the blocklist, with pathinfo() preserving inner .php stems in saved filenames. The blocklist also omits executable extensions including .php6, .shtml, and .htaccess. The double-extension bypass requires a legacy Apache AddHandler configuration to achieve PHP execution; the incomplete blocklist bypass does not.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0044 38th percentileScored 2026-11-07
Fix Fixed laravel-medialibrary (spatie): 11.23.0spatie/laravel-medialibrary (Packagist): 11.23.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
spatielaravel-medialibrarybefore 11.23.011.23.0Patch availableCNA
—spatie/laravel-medialibrary (Packagist)before 11.23.011.23.0Patch availableGHSA-3ggm-c5m7-hfv5
  • laravel-medialibrary Vendorspatie Affected before 11.23.0 Fixed in 11.23.0 Patch available CNA
  • spatie/laravel-medialibrary (Packagist) Vendor— Affected before 11.23.0 Fixed in 11.23.0 Patch available GHSA-3ggm-c5m7-hfv5

Remediation

  • Fix · CNA laravel-medialibrary (spatie) Fixed in 11.23.0
  • Fix · GHSA-3ggm-c5m7-hfv5 spatie/laravel-medialibrary (Packagist) Fixed in 11.23.0 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    spatie laravel-medialibrary 11.23.0

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-35914 Spatie Laravel Media Library < 11.23.0 SSRF via addMediaFromUrl()Priority LOW 24
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48557
  2. 2026-10-03 Alias added: GHSA-3ggm-c5m7-hfv5
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Patch 2

Advisory 1

Other 2

  • TI-2022-21618 Browsershot 3.57.3 - Server Side XSS to LFR via HTML CVSS 3.1HIGH 8.2
  • TI-2022-21617 Browsershot 3.57.2 - Server Side XSS to LFR via HTML CVSS 3.1HIGH 8.2
  • TI-2022-20098 Browsershot 3.57.2 - Server Side XSS to LFR via URL CVSS 3.1HIGH 8.2
  • TI-2026-63016 spatie Scotty Self Update SelfUpdater.php update code download CVSS 4.0MEDIUM 5.3
  • TI-2026-63015 spatie Scotty Doctor DoctorCommand.php checkRemoteTools os command injection CVSS 4.0MEDIUM 5.3
  • TI-2021-20389 The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel… CVSS 3.1CRITICAL 9.8
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences