CVE-2026-48557: Laravel Media Library Path Traversal

CVE-2026-48557 Overview

CVE-2026-48557 is a file upload restriction bypass in the Spatie Laravel Media Library package affecting versions prior to 11.23.0. The flaw resides in FileAdder::defaultSanitizer(), which validates only the final filename suffix. Attackers can submit double-extension filenames such as shell.php.jpg to bypass the blocklist, while pathinfo() preserves the inner .php stem in the saved filename. The blocklist also omits dangerous executable extensions including .php6, .shtml, and .htaccess. The vulnerability falls under [CWE-184] (Incomplete List of Disallowed Inputs).

Critical Impact
An authenticated attacker can upload files that bypass the package's extension blocklist, potentially leading to PHP execution when the application runs on a legacy Apache configuration using AddHandler directives.

Affected Products

Spatie Laravel Media Library versions prior to 11.23.0
Laravel applications integrating spatie/laravel-medialibrary with default sanitizer configuration
Deployments served by Apache with legacy AddHandler PHP configuration

Discovery Timeline

2026-05-29 - CVE-2026-48557 published to the National Vulnerability Database (NVD)
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2026-48557

Vulnerability Analysis

The vulnerability exists in the FileAdder::defaultSanitizer() method, which enforces upload restrictions by inspecting the trailing filename suffix. The sanitizer compares only the last extension segment against a static blocklist of executable types. Filenames containing multiple extensions, such as shell.php.jpg, satisfy the trailing-suffix check while retaining the inner .php component during storage.

After the sanitizer approves the upload, the library uses PHP's pathinfo() to derive the stored filename. pathinfo() returns the segment before the final dot, which preserves shell.php as the base name. The resulting file is written to disk with both extensions intact.

A secondary defect compounds the issue. The blocklist omits several executable extensions that Apache and PHP runtimes treat as code. Specifically, .php6, .shtml, and .htaccess are not blocked. Unlike the double-extension path, exploiting these omitted extensions does not require any non-default Apache handler configuration.

Root Cause

The root cause is an incomplete denylist combined with naive suffix parsing. The sanitizer trusts the final extension fragment rather than evaluating every dot-delimited segment. The blocklist is also incomplete, failing to enumerate all executable extensions recognized by typical PHP deployment stacks.

Attack Vector

An authenticated user with permission to upload media submits a file whose name contains a forbidden extension followed by an allowed one, for example payload.php.jpg. The sanitizer accepts the filename based on the .jpg suffix. The library stores the file under a name that still contains .php. On servers configured with the legacy Apache directive AddHandler application/x-httpd-php .php, requesting the stored file triggers PHP interpretation of its contents. The omitted-extension path, using files such as .htaccess or .shtml, requires no special handler configuration to achieve impact.

No verified public proof-of-concept code is available. Technical details are documented in the VulnCheck Security Advisory and the upstream GitHub Pull Request Discussion.

Detection Methods for CVE-2026-48557

Indicators of Compromise

Stored media files containing multiple extensions, particularly patterns matching *.php*.*, *.phtml.*, or *.phar.*
Uploaded files with extensions .php6, .shtml, or .htaccess in directories managed by the media library
Web server access logs showing successful GET requests to media storage paths that return PHP-generated content
Newly written .htaccess files modifying handler or rewrite rules under upload directories

Detection Strategies

Audit the media library storage disk for filenames matching regex \.(php[0-9]?|phtml|phar|shtml|htaccess)\. or trailing on disallowed extensions
Inspect Laravel application logs and media database table entries for file_name values containing more than one extension
Correlate upload events with subsequent HTTP requests to the same path that result in dynamic responses

Monitoring Recommendations

Monitor the upload directory for file creation events involving executable suffixes using endpoint and cloud workload telemetry
Alert on Apache configuration files referencing AddHandler for PHP types within tenant-writable directories
Forward web server, application, and storage events to a centralized analytics platform such as Singularity Data Lake to correlate upload activity with post-upload access patterns

How to Mitigate CVE-2026-48557

Immediate Actions Required

Upgrade spatie/laravel-medialibrary to version 11.23.0 or later via Composer
Inventory all applications that depend on the package and verify their installed versions
Review existing media storage for files containing double extensions or blocklisted suffixes and quarantine suspect artifacts
Restrict write permissions on upload directories and ensure they are served from a location that does not execute scripts

Patch Information

The maintainers fixed the issue in the GitHub Release Version 11.23.0. The corrective code is in the GitHub Commit Update, which strengthens the sanitizer to evaluate all filename segments and expands the blocklist to include previously omitted executable extensions.

Workarounds

Replace the default sanitizer with a custom implementation that parses every dot-delimited segment against an explicit allowlist of permitted extensions
Remove legacy Apache AddHandler directives that map any .php-containing filename to the PHP interpreter
Configure the web server to deny execution of files under user-controlled media directories using php_flag engine off or equivalent location-based rules
Validate uploaded file content using MIME sniffing and re-encode images server-side before persisting them to storage

bash

# Configuration example
composer require "spatie/laravel-medialibrary:^11.23.0"
php artisan config:clear