CVE-2026-48555 Overview
CVE-2026-48555 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in the Spatie Laravel Media Library package before version 11.23.0. The flaw resides in the addMediaFromUrl() method within InteractsWithMedia.php. The method accepts user-controlled URLs without validating the target host, scheme, or address range. Remote attackers with low privileges can coerce the server into issuing arbitrary outbound HTTP requests. This enables interaction with internal network services, cloud metadata endpoints, and other resources that should not be reachable from external clients.
Critical Impact
Authenticated attackers can pivot through the vulnerable application to probe internal infrastructure, exfiltrate metadata, and reach services that trust the application server's network position.
Affected Products
- Spatie Laravel Media Library versions prior to 11.23.0
- Laravel applications using addMediaFromUrl() with user-supplied input
- Web services exposing media upload functionality backed by the vulnerable package
Discovery Timeline
- 2026-05-29 - CVE-2026-48555 published to NVD
- 2026-05-29 - Last updated in NVD database
Technical Details for CVE-2026-48555
Vulnerability Analysis
The Spatie Laravel Media Library provides helper methods for ingesting media files into Laravel applications. The addMediaFromUrl() method fetches a remote resource and stores it as a media item. Before version 11.23.0, the method passed the supplied URL directly to the underlying HTTP client without restricting the destination.
An attacker who can invoke the upload code path can submit URLs pointing to internal-only hosts. Targets include 127.0.0.1, RFC1918 ranges, link-local addresses such as 169.254.169.254, and Unix-style URI schemes. The server then issues the request from its own network context, returning content or timing signals that disclose internal topology.
Fix details are documented in the GitHub commit 608ea037, the related pull request #3939, and the VulnCheck SSRF advisory.
Root Cause
The root cause is missing validation of user-controlled URLs before they reach the HTTP fetcher. The method did not enforce an allowlist of schemes, did not resolve and check the destination IP against private ranges, and did not restrict redirect targets. This matches the classic SSRF pattern described in [CWE-918].
Attack Vector
Exploitation requires network access to an endpoint that calls addMediaFromUrl() with attacker-supplied input. The attacker submits a crafted URL such as one targeting http://169.254.169.254/latest/meta-data/ on AWS-hosted deployments. The application performs the request server-side, and response content or behavior may be reflected back to the attacker through error messages, stored media records, or timing differences.
No verified public proof-of-concept code is available. Refer to the VulnCheck advisory for exploitation context.
Detection Methods for CVE-2026-48555
Indicators of Compromise
- Outbound HTTP requests from the application server to internal IP ranges, including 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.
- Application logs showing calls to addMediaFromUrl() with non-standard schemes such as file://, gopher://, or dict://.
- Requests to cloud metadata endpoints such as 169.254.169.254 originating from the web application process.
Detection Strategies
- Inspect web server and PHP-FPM logs for media upload endpoints receiving URL parameters that resolve to private addresses.
- Correlate egress proxy or firewall logs with application request IDs to identify unauthorized internal lookups.
- Audit calls to addMediaFromUrl() in source code review to confirm input validation is applied at the controller layer.
Monitoring Recommendations
- Alert on outbound traffic from application subnets to metadata services and RFC1918 ranges that should not be reached from web tier hosts.
- Track HTTP response sizes and status codes returned to clients submitting media URLs to spot reflected SSRF responses.
- Enable Laravel application logging at the info level for the media library namespace to capture URL fetch attempts.
How to Mitigate CVE-2026-48555
Immediate Actions Required
- Upgrade spatie/laravel-medialibrary to version 11.23.0 or later using Composer.
- Audit application controllers for any route that forwards user-supplied URLs to addMediaFromUrl().
- Restrict egress traffic from application servers to known external destinations using a firewall or proxy allowlist.
Patch Information
The fix is included in Spatie Laravel Media Library 11.23.0. The patch introduces URL validation in InteractsWithMedia.php to reject unsafe destinations. Review the upstream commit for implementation details.
Workarounds
- Replace direct calls to addMediaFromUrl() with addMediaFromDisk() or addMediaFromRequest() where feasible.
- Implement an application-layer URL validator that resolves the hostname and rejects private, loopback, and link-local IP addresses before invoking the media library.
- Route outbound HTTP requests from PHP through a forward proxy that enforces destination allowlists and blocks metadata IPs.
# Configuration example
composer require spatie/laravel-medialibrary:^11.23.0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
