CVE-2026-4809 - Vulnerability Analysis

Overview

plank/laravel-mediable <= 6.4.0 contains an unrestricted file upload vulnerability caused by accepting client-supplied MIME types during file upload, letting remote attackers upload executable PHP files, potentially leading to remote code execution, exploit requires application to accept client MIME types.

Severity & Score

Impact

Remote attackers can upload executable PHP files, potentially leading to remote code execution on the server.

Mitigation

Update to the latest version once available or implement strict server-side MIME type validation.

References

• https://github.com/plank/laravel-mediable
• https://github.com/plank/laravel-mediable/releases/tag/6.4.0

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 26, 2026

🔴 CVE-2026-4809 - Critical (9.8) plank/laravel-mediable through version 6.4.0 can allow upload of a dangerous file type when an application using the package accepts or prefers a client-supplied MIME type during file upload handling. In that configuration, a remote attacker can s... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4809/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner