CVE-2026-49969: Laravel-Mediable SSRF Vulnerability

CVE-2026-49969 Overview

CVE-2026-49969 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in the Laravel-Mediable package prior to version 7.0.0. The package accepts caller-controlled URLs through MediaUploader::fromSource() and processes them via RemoteUrlAdapter without validating the destination. Remote attackers with low privileges can supply URLs that target internal infrastructure, RFC-1918 addresses, loopback interfaces, cloud metadata endpoints, or file:// URIs. Successful exploitation lets attackers retrieve internal resources and exfiltrate cloud credentials such as IAM tokens from instance metadata services.

Critical Impact
Attackers can pivot from a public-facing Laravel application into private cloud infrastructure, reaching AWS/Azure/GCP metadata endpoints to steal IAM credentials and read arbitrary local files through the file:// scheme.

Affected Products

plank/laravel-mediable versions prior to 7.0.0
Laravel applications using MediaUploader::fromSource() with user-supplied URLs
Deployments relying on the default RemoteUrlAdapter configuration

Discovery Timeline

2026-07-13 - CVE-2026-49969 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-49969

Vulnerability Analysis

The flaw resides in Laravel-Mediable's RemoteUrlAdapter, which is invoked when MediaUploader::fromSource() receives a URL string. The adapter fetches the target URL server-side to ingest the remote file as a media asset. Prior to version 7.0.0 no allowlist enforcement existed for the destination host or URL scheme.

Because the request originates from the application server, attackers can reach networks and services that are unreachable from the public internet. This includes internal HTTP APIs, database admin panels, and cloud provider Instance Metadata Services (IMDS) at 169.254.169.254. The file:// scheme also grants read access to arbitrary files on the server's filesystem through the same adapter path.

Root Cause

The root cause is missing input validation on user-controlled URLs before performing an outbound request. The library trusted the caller to sanitize destinations, but developers commonly wire the parameter directly to HTTP request handlers. No default deny-list existed for private address ranges, loopback, link-local metadata addresses, or non-HTTP schemes.

Attack Vector

An authenticated attacker submits a crafted URL to any endpoint that funnels input into MediaUploader::fromSource(). Example payloads include http://169.254.169.254/latest/meta-data/iam/security-credentials/ to steal AWS IAM role credentials, http://127.0.0.1:6379/ to interact with local Redis, or file:///etc/passwd to read local files. The response body is stored as a media asset that the attacker can subsequently download.

php

      */
     'allowed_aggregate_types' => [],
 
+    /*
+     * Only allow remote files to be imported from specific host(s)
+     * If empty, will allow any host that is not a private IP address or localhost
+     */
+    'allowed_remote_hosts' => [],
+
+    /*
+     * Only allow remote files to be imported from URLs with specific scheme(s)
+     * If empty, will allow any scheme supported by the application.
+     * If modifying this value, be sure to also update the pattern matching in `source_adapters` as well
+     */
+    'allowed_remote_schemes' => ['https'],
+
     /*
      * List of aggregate types recognized by the application
      *

Source: GitHub commit 7e9e300 — the patch introduces allowed_remote_hosts and allowed_remote_schemes configuration keys and defaults scheme validation to https only.

Detection Methods for CVE-2026-49969

Indicators of Compromise

Outbound HTTP requests from the Laravel application server to 169.254.169.254, 127.0.0.1, or RFC-1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
Media records in the database whose source URL contains file://, gopher://, or link-local IP addresses.
Web server access logs showing user input to fromSource()-backed endpoints containing internal hostnames or metadata URLs.
Unexpected latest/meta-data/iam/security-credentials/ fetches from the application host.

Detection Strategies

Instrument the application to log every URL passed to MediaUploader::fromSource() and alert on non-public destinations.
Deploy egress network monitoring that flags application-server connections to metadata endpoints or private ranges.
Review Laravel job queues and media storage for artifacts whose fetched content resembles credential material or system files.

Monitoring Recommendations

Enable HTTP client middleware logging in Guzzle to capture request URLs and response sizes for RemoteUrlAdapter traffic.
Monitor cloud provider CloudTrail/audit logs for use of IAM credentials from unexpected source IPs, indicating credential theft.
Correlate application error logs with unusual file:// or http://localhost URL patterns in user-submitted parameters.

How to Mitigate CVE-2026-49969

Immediate Actions Required

Upgrade plank/laravel-mediable to version 7.0.0 or later via composer require plank/laravel-mediable:^7.0.
Populate allowed_remote_hosts in config/mediable.php with an explicit allowlist of trusted upstream hosts.
Restrict allowed_remote_schemes to https only and audit any custom source_adapters entries.
Rotate any cloud IAM credentials, API keys, and session tokens accessible from the application host if exploitation is suspected.

Patch Information

The fix is delivered in Laravel-Mediable 7.0.0 via commit 7e9e3000fa05fe16e678f15bfb51a091e60c2cb8. See the VulnCheck Security Advisory for advisory details. The patch adds host and scheme allowlists to config/mediable.php and blocks private IPs and localhost by default when the allowlist is empty.

Workarounds

Enforce IMDSv2 with session tokens on AWS EC2 instances to prevent trivial credential theft via basic SSRF.
Block outbound traffic from application servers to 169.254.169.254 and internal management subnets at the network layer.
Reject user-submitted URLs at the application boundary using DNS resolution checks against RFC-1918 and link-local ranges before invoking MediaUploader::fromSource().

bash

# config/mediable.php — post-patch hardening example
'allowed_remote_hosts' => ['cdn.example.com', 'assets.example.com'],
'allowed_remote_schemes' => ['https'],