Read the docs
TI-2026-63016 Aliases CVE-2026-93534GHSA-m88j-9w7j-676j

spatie Scotty Self Update SelfUpdater.php update code download

Priority MEDIUM 63CWE-494Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-494.

Summary

A vulnerability was identified in spatie Scotty up to 1.4.2. Affected is the function SelfUpdater::update of the file app/Updater/SelfUpdater.php of the component Self Update Handler. Such manipulation leads to download of code without integrity check. It is possible to launch the attack remotely. Upgrading to version 1.4.3 is able to address this issue. The name of the patch is 4b4e11bfc98e3a2159bb2b3d9b040293fcc44744. It is advisable to upgrade the affected component.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00213 11th percentileScored 2026-11-07
Fix Fixed Scotty (spatie): 1.4.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
spatieScotty1.4.0; 1.4.1; 1.4.21.4.3Patch availableCNA
  • Scotty Vendorspatie Affected 1.4.0; 1.4.1; 1.4.2 Fixed in 1.4.3 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:spatie:scotty:*:*:*:*:*:*:*:*——spatie
  • cpe:2.3:a:spatie:scotty:*:*:*:*:*:*:*:* Versions — — ·spatie

Remediation

  • Fix · CNA Scotty (spatie) Fixed in 1.4.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-93534
  2. 2026-10-03 Alias added: GHSA-m88j-9w7j-676j

References

Patch 2

Other 2

  • TI-2022-21618 Browsershot 3.57.3 - Server Side XSS to LFR via HTML CVSS 3.1HIGH 8.2
  • TI-2022-21617 Browsershot 3.57.2 - Server Side XSS to LFR via HTML CVSS 3.1HIGH 8.2
  • TI-2022-20098 Browsershot 3.57.2 - Server Side XSS to LFR via URL CVSS 3.1HIGH 8.2
  • TI-2026-63015 spatie Scotty Doctor DoctorCommand.php checkRemoteTools os command injection CVSS 4.0MEDIUM 5.3
  • TI-2021-20389 The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel… CVSS 3.1CRITICAL 9.8
  • TI-2026-35915 Spatie Laravel Media Library < 11.23.0 File Upload Restriction Bypass via FileAdder.php CVSS 4.0HIGH 8.7
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences