CVE-2026-93352

Received Received - Intake

Laravel-Mediable Remote Code Execution via .pht File Upload

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: VulnCheck

Description

Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49972 in which the .pht extension is absent from the forbidden_extensions blocklist in config/mediable.php. The blocklist introduced to address CVE-2026-49972 includes phpt but omits pht, which Apache executes as PHP via the default FilesMatch directive on Debian and Ubuntu systems. An attacker can upload a .pht file that passes all validation in MediaUploader::verifyExtension() and File::sanitizeFileName() because pht is not present in the blocklist, causing the file to be written to disk and executed as PHP when requested, enabling remote code execution with the privileges of the web server process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-23

Generated

2026-09-24

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-93352

Affected Vendors & Products

Vendor	Product	Version / Range
spatie	laravel-mediable	to 7.0.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

Laravel-Mediable 7.0.0 before 7.0.2 has an incomplete fix for CVE-2026-49972. The blocklist in config/mediable.php misses the .pht extension, which Apache treats as PHP on Debian and Ubuntu systems. Attackers can upload .pht files that bypass validation and execute as PHP, leading to remote code execution with web server privileges.

Detection Guidance

Check for .pht files in your Laravel-Mediable upload directories. Use commands like 'find /path/to/uploads -name "*.pht"' to locate suspicious files. Review Apache access logs for requests to .pht files.

Impact Analysis

An attacker could exploit this to run malicious code on your server, potentially stealing data, installing malware, or taking control of the system. This could affect confidentiality, integrity, and availability of your services.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR (data protection) and HIPAA (health information privacy). Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Update Laravel-Mediable to version 7.0.2 or later. Add .pht to the forbidden_extensions blocklist in config/mediable.php. Restrict file uploads to trusted extensions only.

Hi! I’m here to help you understand CVE-2026-93352. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70