GHSA-3ggm-c5m7-hfv5

Suggest an improvement
Source
https://github.com/advisories/GHSA-3ggm-c5m7-hfv5
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-3ggm-c5m7-hfv5/GHSA-3ggm-c5m7-hfv5.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-3ggm-c5m7-hfv5
Aliases
Published
2026-05-29T21:31:25Z
Modified
2026-09-10T03:50:45Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Spatie Laravel Media Library contains a file upload restriction bypass
Details

Spatie Laravel Media Library before version 11.23.0 contains a file upload restriction bypass in FileAdder::defaultSanitizer(). The sanitizer checks only the final filename suffix, allowing double-extension filenames such as shell.php.jpg to bypass the blocklist, with pathinfo() preserving inner .php stems in saved filenames. The blocklist also omits executable extensions including .php6, .shtml, and .htaccess. The double-extension bypass requires a legacy Apache AddHandler configuration to achieve PHP execution; the incomplete blocklist bypass does not.

Database specific 
{
    "cwe_ids":  [
        "CWE-184"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-02T21:02:07Z",
    "nvd_published_at":  "2026-05-29T20:16:28Z",
    "severity":  "HIGH"
}
References

Affected packages

Packagist / spatie/laravel-medialibrary

Package

Name
spatie/laravel-medialibrary
Purl
pkg:composer/spatie/laravel-medialibrary

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
11.23.0

Affected versions

0.*
0.1.0
1.*
1.0.0
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.5.6
1.6.0
1.6.1
1.6.2
2.*
2.0.0
2.0.1
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
2.2.1
2.2.2
2.2.3
2.3.0
3.*
3.0.0
3.0.1
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.3.0
3.3.1
3.4.0
3.5.0
3.5.1
3.6.0
3.7.0
3.7.1
3.7.2
3.7.3
3.8.0
3.9.0
3.9.1
3.9.2
3.10.0
3.10.1
3.10.2
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
3.12.2
3.13.3
3.13.4
3.14.0
3.14.1
3.15.0
3.16.0
3.16.1
3.17.0
3.17.1
3.17.2
3.17.3
3.17.4
3.18.0
4.*
4.0.0
4.0.1
4.1
4.2
4.2.1
4.3.0
4.4.0
4.4.1
4.5.0
4.6.0
4.7.0
4.7.1
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.9.0
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.10.0
4.10.1
4.10.2
4.10.3
4.11.0
4.11.1
4.11.2
4.11.3
4.12.0
4.12.1
4.13.0
4.13.1
4.13.2
4.13.3
4.13.4
4.13.5
5.*
5.0.0
5.0.1
5.0.2
5.1.0
5.2.0
5.3.0
5.3.1
5.3.2
5.3.3
5.4.0
5.5.0
5.5.1
5.5.2
5.5.3
5.6.0
5.7.0
5.8.0
5.8.1
5.8.2
5.9.0
5.10.0
5.11.0
5.11.1
5.12.0
5.12.1
5.13.0
5.13.1
5.13.2
5.14.0
6.*
6.0.0
6.1.0
6.1.1
6.1.2
6.1.3
6.2.0
6.2.1
6.3.0
6.4.0
6.4.1
6.4.2
6.5.0
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.6.7
6.6.8
6.6.9
6.7.0
6.8.0
6.9.0
6.9.1
6.9.2
7.*
7.0.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.1.0
7.1.1
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.3.0
7.3.1
7.3.2
7.3.3
7.3.4
7.3.5
7.3.6
7.3.7
7.3.8
7.3.9
7.3.10
7.3.11
7.3.12
7.4.0
7.4.1
7.4.2
7.4.3
7.5.0
7.5.1
7.5.2
7.5.3
7.5.4
7.5.5
7.5.6
7.6.0
7.6.1
7.6.2
7.6.3
7.6.4
7.6.5
7.6.6
7.6.7
7.6.8
7.6.9
7.7.0
7.8.0
7.8.1
7.8.2
7.9.0
7.10.0
7.10.1
7.11.0
7.12.0
7.12.1
7.12.2
7.12.3
7.12.4
7.13.0
7.14.0
7.14.1
7.14.2
7.16.0
7.16.1
7.16.2
7.17.0
7.17.1
7.18.0
7.18.1
7.18.2
7.18.3
7.19.0
7.19.1
7.19.2
7.19.3
7.19.4
7.19.5
7.20.0
8.*
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.2.0
8.2.1
8.2.2
8.2.3
8.2.4
8.2.5
8.2.6
8.2.7
8.2.9
8.3.0
8.3.1
8.3.2
8.3.3
8.4.0
8.4.1
8.5.0
8.5.1
8.5.2
8.6.0
8.7.0
8.7.1
8.7.2
8.7.3
8.7.4
8.7.5
8.8.0
8.9.0
8.9.1
8.9.2
8.9.3
8.10.0
8.10.1
8.10.2
9.*
9.0.0
9.0.1
9.1.0
9.1.1
9.1.2
9.1.3
9.1.4
9.1.5
9.1.6
9.1.7
9.2.0
9.3.0
9.4.0
9.4.1
9.4.2
9.4.3
9.4.4
9.5.0
9.5.1
9.5.2
9.5.3
9.5.4
9.5.5
9.5.6
9.6.0
9.6.1
9.6.2
9.6.3
9.6.4
9.7.0
9.7.1
9.7.2
9.7.3
9.7.4
9.7.5
9.8.0
9.8.1
9.8.2
9.8.3
9.8.4
9.9.0
9.9.1
9.10.0
9.10.1
9.10.2
9.10.3
9.11.0
9.11.1
9.11.2
9.11.3
9.11.4
9.12.0
9.12.1
9.12.2
9.12.3
9.12.4
10.*
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.0.6
10.0.7
10.1.0
10.1.1
10.1.2
10.1.3
10.1.4
10.1.5
10.2.0
10.3.0
10.3.1
10.3.2
10.3.3
10.3.4
10.3.5
10.3.6
10.4.0
10.4.1
10.4.2
10.4.3
10.4.4
10.4.5
10.5.0
10.5.1
10.5.2
10.6.0
10.6.1
10.7.0
10.7.1
10.7.2
10.7.3
10.7.4
10.7.5
10.7.6
10.7.7
10.7.8
10.7.9
10.7.10
10.7.11
10.7.12
10.7.13
10.7.14
10.7.15
10.7.16
10.8.0
10.9.0
10.9.1
10.9.2
10.9.3
10.9.4
10.10.0
10.10.1
10.10.2
10.11.0
10.11.1
10.11.2
10.11.3
10.11.4
10.12.0
10.12.1
10.12.2
10.13.0
10.13.1
10.13.2
10.14.0
10.15.0
11.*
11.0.0
11.0.1
11.0.2
11.0.3
11.0.4
11.0.5
11.1.0
11.1.1
11.1.2
11.2.0
11.3.0
11.3.1
11.4.0
11.4.1
11.4.2
11.4.3
11.4.4
11.4.5
11.4.6
11.4.7
11.4.8
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
11.6.0
11.6.1
11.7.0
11.7.1
11.7.2
11.7.3
11.7.4
11.7.5
11.7.6
11.8.0
11.8.1
11.8.2
11.8.3
11.9.0
11.9.1
11.9.2
11.10.0
11.10.1
11.11.0
11.11.1
11.12.0
11.12.1
11.12.2
11.12.3
11.12.4
11.12.5
11.12.6
11.12.7
11.12.8
11.12.9
11.13.0
11.14.0
11.15.0
11.16.0
11.17.0
11.17.1
11.17.2
11.17.3
11.17.4
11.17.5
11.17.6
11.17.7
11.17.8
11.17.9
11.17.10
11.18.0
11.18.1
11.18.2
11.19.0
11.20.0
11.21.0
11.21.1
11.21.2
11.22.0
11.22.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-3ggm-c5m7-hfv5/GHSA-3ggm-c5m7-hfv5.json"