CVE-2026-4809

plank/laravel-mediable through version 6.4.0 can allow upload of a dangerous file type when an application using the package accepts or prefers a client-supplied MIME type during file upload handling. In that configuration, a remote attacker can submit a file containing executable PHP code while declaring a benign image MIME type, resulting in arbitrary file upload.

Score

CVSS 3.1 9.8 Critical

Status

Deferred - 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Published

2026-03-26

Last modified

2026-08-10

Weaknesses

CWE-434

Affected products

• Laravel-mediable (Plank)

References

• https://github.com/plank/laravel-mediable
• https://github.com/plank/laravel-mediable/releases/tag/6.4.0