High severity8.8NVD Advisory· Published May 29, 2026· Updated Jul 22, 2026
CVE-2026-48557
CVE-2026-48557
Description
Spatie Laravel Media Library before version 11.23.0 contains a file upload restriction bypass in FileAdder::defaultSanitizer(). The sanitizer checks only the final filename suffix, allowing double-extension filenames such as shell.php.jpg to bypass the blocklist, with pathinfo() preserving inner .php stems in saved filenames. The blocklist also omits executable extensions including .php6, .shtml, and .htaccess. The double-extension bypass requires a legacy Apache AddHandler configuration to achieve PHP execution; the incomplete blocklist bypass does not.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
spatie/laravel-medialibraryPackagist | < 11.23.0 | 11.23.0 |
Affected products
2(expand)+ 1 more
- (no CPE)
- (no CPE)range: <11.23.0
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-3ggm-c5m7-hfv5ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-48557ghsaADVISORY
- github.com/spatie/laravel-medialibrary/commit/608ea03703d3887c46434f5dda6af56de6346abanvdWEB
- github.com/spatie/laravel-medialibrary/pull/3939nvdWEB
- github.com/spatie/laravel-medialibrary/releases/tag/11.23.0nvdWEB
- www.vulncheck.com/advisories/spatie-laravel-media-library-file-upload-restriction-bypass-via-fileadder-phpnvdWEB
News mentions
0No linked articles in our index yet.