CVE-2026-4809

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-4809
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4809.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-4809
Published
2026-03-26T11:03:27.086Z
Modified
2026-08-07T11:51:16.616612554Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Unsafe Client MIME Type Handling Can Enable Arbitrary File Upload in plank/laravel-mediable
Details

plank/laravel-mediable through version 6.4.0 can allow upload of a dangerous file type when an application using the package accepts or prefers a client-supplied MIME type during file upload handling. In that configuration, a remote attacker can submit a file containing executable PHP code while declaring a benign image MIME type, resulting in arbitrary file upload. If the uploaded file is stored in a web-accessible and executable location, this may lead to remote code execution. At the time of publication, no patch was available and the vendor had not responded to coordinated disclosure attempts.

Database specific 
{
    "cwe_ids": [
        "CWE-434"
    ],
    "cna_assigner": "TuranSec",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4809.json"
}
References

Affected packages

Git / github.com/plank/laravel-mediable

Affected ranges

Type
GIT
Repo
https://github.com/plank/laravel-mediable
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
56cc3c69654e250deb0badd2a8870d1f729f29e3
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "6.4.0"
        },
        {
            "fixed": "6.4.0"
        }
    ]
}

Affected versions

0.*
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.2.0
0.3.0
1.*
1.0.0
1.0.1
2.*
2.0.0
2.1.0
2.2.3
2.3.0
2.4.0
2.4.1
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.5.0
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.7.2
2.7.3
2.8.0
2.8.1
2.8.2
2.9.0
3.*
3.0.0
3.0.1
4.*
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.3.0
4.3.1
4.3.2
4.4.0
4.4.1
4.4.2
5.*
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.1.0
5.1.1
5.2.0
5.2.1
5.3.1
5.4.0
5.4.1
5.5.0
5.6.0
5.7.0
5.8.0
5.9.0
5.9.1
6.*
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.1.0
6.1.1
6.1.2
6.1.3
6.2.0
6.2.1
6.3.0
6.3.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4809.json"