CVE-2026-49970: Laravel-Mediable Path Traversal Flaw

CVE-2026-49970 Overview

CVE-2026-49970 is a path traversal vulnerability [CWE-22] in the Laravel-Mediable package before version 7.0.0. The flaw resides in the File::sanitizePath() helper, which fails to properly restrict directory separators and relative path components. Attackers with the ability to trigger MediaUploader::toDestination() with a controlled directory argument can write uploaded files outside the intended storage path. Successful exploitation permits writing to sensitive locations such as the document root, .env files, or configuration directories, which can lead to remote code execution.

Critical Impact
An authenticated attacker who controls the destination directory passed to the uploader can achieve arbitrary file write and potential remote code execution on Laravel applications using vulnerable versions of the Mediable package.

Affected Products

Plank Laravel-Mediable versions prior to 7.0.0
Laravel applications integrating MediaUploader::toDestination() with user-controlled directory input
Any deployment using the vulnerable File::sanitizePath() helper

Discovery Timeline

2026-07-13 - CVE-2026-49970 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-49970

Vulnerability Analysis

The vulnerability originates in the sanitizePath() method inside src/Helpers/File.php. The function relies on a single regular expression to filter characters from a caller-supplied path before it is used as an upload destination. Because the allow-list includes both . and /, sequences such as ../ survive sanitization intact. The subsequent trim() call only strips leading and trailing separators, leaving embedded traversal sequences untouched.

When MediaUploader::toDestination() accepts the sanitized string, the uploader writes the file relative to the storage disk root using the attacker-controlled path. This enables writing PHP files into the web-accessible document root or overwriting configuration files such as .env, config/app.php, or scheduled scripts. The result is arbitrary file write, which commonly escalates to remote code execution on Laravel deployments.

Root Cause

The root cause is permissive input sanitization. The regex /[^a-zA-Z0-9-_\/.%]+/ treats / and . as safe characters and processes the entire path as a single string rather than validating each segment. Relative traversal tokens like .. are never stripped, and no canonicalization step verifies that the resolved path stays within the intended base directory.

Attack Vector

An attacker sends an upload request to an endpoint that forwards the directory parameter into MediaUploader::toDestination(). By supplying values containing .. segments, the attacker redirects the uploaded file to any location writable by the PHP process. A payload targeting ../../public combined with a PHP file extension yields a webshell reachable via the application URL.

php

// Security patch in src/Helpers/File.php - CVE-2026-49970
public static function sanitizePath(string $path, ?string $language = null): string
{
    $language = $language ?: App::currentLocale();
    $ascii    = Str::ascii($path, $language);
    $ascii    = str_replace('\\', '/', $ascii);
    $segments = explode('/', $ascii);
    $safe     = [];
    foreach ($segments as $segment) {
        if ($segment === '..' || $segment === '.' || $segment === '') {
            continue;
        }
        $safe[] = trim(preg_replace('/[^a-zA-Z0-9\-_%]+/', '-', $segment), '-');
    }
    return implode('/', array_filter($safe));
}

Source: GitHub Commit 6d1e7fb. The patch splits the path into segments, discards ., .., and empty entries, and sanitizes each segment individually before rejoining.

Detection Methods for CVE-2026-49970

Indicators of Compromise

Upload requests containing .., ..%2f, or encoded backslash sequences in directory or path parameters
New or modified files with executable extensions (.php, .phtml, .phar) in public/, storage/app/public/, or the application root
Unexpected modifications to .env, config/*.php, or scheduler-related files
Media records in the database whose directory column contains traversal tokens

Detection Strategies

Inspect web server access logs for POST requests to upload endpoints where request bodies include ../ sequences in destination fields
Enable Laravel request logging on media routes and alert on directory inputs that fail a strict allow-list check
Perform static analysis on application code to identify call sites of MediaUploader::toDestination() that receive request-derived input

Monitoring Recommendations

Monitor file system integrity for the Laravel public/ directory and configuration files using host-based integrity tools
Alert on creation of PHP files outside expected build or deployment pipelines
Track outbound connections and process launches from the PHP-FPM or web server user immediately following media upload activity

How to Mitigate CVE-2026-49970

Immediate Actions Required

Upgrade plank/laravel-mediable to version 7.0.0 or later via Composer
Audit application code for calls to MediaUploader::toDestination() that pass user-supplied values, and enforce a server-side allow-list of directories
Review recent uploads and media records for entries containing .. or absolute path fragments
Rotate any credentials stored in .env if unauthorized modification cannot be ruled out

Patch Information

The fix is available in Laravel-Mediable 7.0.0. The patched sanitizePath() implementation splits the path on directory separators, discards . and .. segments, and sanitizes each remaining segment independently. See the VulnCheck advisory for additional details.

Workarounds

Wrap calls to MediaUploader::toDestination() with a validator that rejects any input containing .., \, or leading /
Hardcode the destination directory server-side and never propagate client-supplied path fragments to the uploader
Restrict the PHP process filesystem permissions so it cannot write to the document root or configuration directories

bash

# Composer upgrade to the patched release
composer require plank/laravel-mediable:^7.0.0
composer update plank/laravel-mediable
php artisan config:clear