GHSA-fggg-964j-3j7h

Suggest an improvement
Source
https://github.com/advisories/GHSA-fggg-964j-3j7h
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-fggg-964j-3j7h/GHSA-fggg-964j-3j7h.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-fggg-964j-3j7h
Aliases
Published
2026-05-29T21:31:24Z
Modified
2026-09-10T03:50:46Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L CVSS Calculator
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L CVSS Calculator
Summary
Spatie Laravel Media Library contains a server-side request forgery vulnerability
Details

Spatie Laravel Media Library before version 11.23.0 contains a server-side request forgery vulnerability that allows remote attackers to cause the server to issue arbitrary outbound HTTP requests by passing user-controlled URLs to the addMediaFromUrl() method in InteractsWithMedia.php.

Database specific 
{
    "cwe_ids":  [
        "CWE-918"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-02T21:12:18Z",
    "nvd_published_at":  "2026-05-29T20:16:28Z",
    "severity":  "MODERATE"
}
References

Affected packages

Packagist / spatie/laravel-medialibrary

Package

Name
spatie/laravel-medialibrary
Purl
pkg:composer/spatie/laravel-medialibrary

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
11.23.0

Affected versions

0.*
0.1.0
1.*
1.0.0
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.5.6
1.6.0
1.6.1
1.6.2
2.*
2.0.0
2.0.1
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
2.2.1
2.2.2
2.2.3
2.3.0
3.*
3.0.0
3.0.1
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.3.0
3.3.1
3.4.0
3.5.0
3.5.1
3.6.0
3.7.0
3.7.1
3.7.2
3.7.3
3.8.0
3.9.0
3.9.1
3.9.2
3.10.0
3.10.1
3.10.2
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
3.12.2
3.13.3
3.13.4
3.14.0
3.14.1
3.15.0
3.16.0
3.16.1
3.17.0
3.17.1
3.17.2
3.17.3
3.17.4
3.18.0
4.*
4.0.0
4.0.1
4.1
4.2
4.2.1
4.3.0
4.4.0
4.4.1
4.5.0
4.6.0
4.7.0
4.7.1
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.9.0
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
4.10.0
4.10.1
4.10.2
4.10.3
4.11.0
4.11.1
4.11.2
4.11.3
4.12.0
4.12.1
4.13.0
4.13.1
4.13.2
4.13.3
4.13.4
4.13.5
5.*
5.0.0
5.0.1
5.0.2
5.1.0
5.2.0
5.3.0
5.3.1
5.3.2
5.3.3
5.4.0
5.5.0
5.5.1
5.5.2
5.5.3
5.6.0
5.7.0
5.8.0
5.8.1
5.8.2
5.9.0
5.10.0
5.11.0
5.11.1
5.12.0
5.12.1
5.13.0
5.13.1
5.13.2
5.14.0
6.*
6.0.0
6.1.0
6.1.1
6.1.2
6.1.3
6.2.0
6.2.1
6.3.0
6.4.0
6.4.1
6.4.2
6.5.0
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
6.6.7
6.6.8
6.6.9
6.7.0
6.8.0
6.9.0
6.9.1
6.9.2
7.*
7.0.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.1.0
7.1.1
7.1.2
7.1.3
7.1.4
7.1.5
7.1.6
7.1.7
7.1.8
7.3.0
7.3.1
7.3.2
7.3.3
7.3.4
7.3.5
7.3.6
7.3.7
7.3.8
7.3.9
7.3.10
7.3.11
7.3.12
7.4.0
7.4.1
7.4.2
7.4.3
7.5.0
7.5.1
7.5.2
7.5.3
7.5.4
7.5.5
7.5.6
7.6.0
7.6.1
7.6.2
7.6.3
7.6.4
7.6.5
7.6.6
7.6.7
7.6.8
7.6.9
7.7.0
7.8.0
7.8.1
7.8.2
7.9.0
7.10.0
7.10.1
7.11.0
7.12.0
7.12.1
7.12.2
7.12.3
7.12.4
7.13.0
7.14.0
7.14.1
7.14.2
7.16.0
7.16.1
7.16.2
7.17.0
7.17.1
7.18.0
7.18.1
7.18.2
7.18.3
7.19.0
7.19.1
7.19.2
7.19.3
7.19.4
7.19.5
7.20.0
8.*
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
8.1.0
8.2.0
8.2.1
8.2.2
8.2.3
8.2.4
8.2.5
8.2.6
8.2.7
8.2.9
8.3.0
8.3.1
8.3.2
8.3.3
8.4.0
8.4.1
8.5.0
8.5.1
8.5.2
8.6.0
8.7.0
8.7.1
8.7.2
8.7.3
8.7.4
8.7.5
8.8.0
8.9.0
8.9.1
8.9.2
8.9.3
8.10.0
8.10.1
8.10.2
9.*
9.0.0
9.0.1
9.1.0
9.1.1
9.1.2
9.1.3
9.1.4
9.1.5
9.1.6
9.1.7
9.2.0
9.3.0
9.4.0
9.4.1
9.4.2
9.4.3
9.4.4
9.5.0
9.5.1
9.5.2
9.5.3
9.5.4
9.5.5
9.5.6
9.6.0
9.6.1
9.6.2
9.6.3
9.6.4
9.7.0
9.7.1
9.7.2
9.7.3
9.7.4
9.7.5
9.8.0
9.8.1
9.8.2
9.8.3
9.8.4
9.9.0
9.9.1
9.10.0
9.10.1
9.10.2
9.10.3
9.11.0
9.11.1
9.11.2
9.11.3
9.11.4
9.12.0
9.12.1
9.12.2
9.12.3
9.12.4
10.*
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
10.0.5
10.0.6
10.0.7
10.1.0
10.1.1
10.1.2
10.1.3
10.1.4
10.1.5
10.2.0
10.3.0
10.3.1
10.3.2
10.3.3
10.3.4
10.3.5
10.3.6
10.4.0
10.4.1
10.4.2
10.4.3
10.4.4
10.4.5
10.5.0
10.5.1
10.5.2
10.6.0
10.6.1
10.7.0
10.7.1
10.7.2
10.7.3
10.7.4
10.7.5
10.7.6
10.7.7
10.7.8
10.7.9
10.7.10
10.7.11
10.7.12
10.7.13
10.7.14
10.7.15
10.7.16
10.8.0
10.9.0
10.9.1
10.9.2
10.9.3
10.9.4
10.10.0
10.10.1
10.10.2
10.11.0
10.11.1
10.11.2
10.11.3
10.11.4
10.12.0
10.12.1
10.12.2
10.13.0
10.13.1
10.13.2
10.14.0
10.15.0
11.*
11.0.0
11.0.1
11.0.2
11.0.3
11.0.4
11.0.5
11.1.0
11.1.1
11.1.2
11.2.0
11.3.0
11.3.1
11.4.0
11.4.1
11.4.2
11.4.3
11.4.4
11.4.5
11.4.6
11.4.7
11.4.8
11.5.0
11.5.1
11.5.2
11.5.3
11.5.4
11.6.0
11.6.1
11.7.0
11.7.1
11.7.2
11.7.3
11.7.4
11.7.5
11.7.6
11.8.0
11.8.1
11.8.2
11.8.3
11.9.0
11.9.1
11.9.2
11.10.0
11.10.1
11.11.0
11.11.1
11.12.0
11.12.1
11.12.2
11.12.3
11.12.4
11.12.5
11.12.6
11.12.7
11.12.8
11.12.9
11.13.0
11.14.0
11.15.0
11.16.0
11.17.0
11.17.1
11.17.2
11.17.3
11.17.4
11.17.5
11.17.6
11.17.7
11.17.8
11.17.9
11.17.10
11.18.0
11.18.1
11.18.2
11.19.0
11.20.0
11.21.0
11.21.1
11.21.2
11.22.0
11.22.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-fggg-964j-3j7h/GHSA-fggg-964j-3j7h.json"