CVE-2026-49970: laravel-mediable 0 to before 7.0.0

Affected technology

laravel-mediable · 0 to before 7.0.0
plank

Description’s affected range: before 7.0.0

Component: Not specified by the source
Function: that

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Attackers can exploit the permissive character-class regex that allows both dot and slash characters combined with an ineffective trailing trim() call to bypass sanitization and upload files to sensitive locations such as the document root, environment configuration files, or application configuration directories, enabling remote code execution. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality, integrity and availability impact as high.