CVE-2026-4809 — AI Deep Analysis Summary

Q: What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Laravel-Mediable accepts client-supplied MIME types. 💥 **Consequence**: Attackers upload PHP files disguised as images. ⚠️ **Result**: Remote Code Execution (RCE) on the server.

Q: Root Cause? (CWE/Flaw)

🛡️ **CWE**: CWE-434 (Unrestricted Upload of File with Dangerous Type). 🔍 **Flaw**: The package trusts the `Content-Type` header from the client instead of validating the actual file content.

Q: Who is affected? (Versions/Components)

📦 **Vendor**: Plank. 📦 **Product**: laravel-mediable. 📉 **Affected**: Versions **6.4.0 and earlier**. ✅ **Safe**: Version 6.4.0+ (see references).

Q: What can hackers do? (Privileges/Data)

👑 **Privileges**: Full RCE as the web server user. 💾 **Data**: Complete compromise of server data, database, and backend systems. 🔓 **Access**: No authentication required (CVSS PR:N).

Q: Is exploitation threshold high? (Auth/Config)

📉 **Threshold**: **LOW**. 🔑 **Auth**: None required (PR:N). 🎯 **Complexity**: Low (AC:L). 👤 **User Interaction**: None needed (UI:N). 🌐 **Network**: Remote (AV:N).

Q: Is there a public Exp? (PoC/Wild Exploitation)

📜 **Public Exp**: No PoC listed in data. 🌍 **Wild Exp**: Likely possible due to low complexity. ⚠️ **Risk**: High potential for automated scanning and exploitation.

Q: How to self-check? (Features/Scanning)

🔍 **Check**: Scan for `laravel-mediable` usage in `composer.json`. 📊 **Version**: Verify installed version is < 6.4.0. 📂 **Files**: Monitor uploads for PHP extensions disguised as images.

Q: Is it fixed officially? (Patch/Mitigation)

✅ **Fixed**: Yes. 🔧 **Patch**: Upgrade to **version 6.4.0** or later. 🔗 **Ref**: See GitHub Release 6.4.0 for details.

Q: What if no patch? (Workaround)

🛡️ **Workaround**: If upgrade is impossible, implement strict server-side MIME validation. 🚫 **Block**: Reject files with PHP extensions or non-image MIME types. 📂 **Store**: Move uploads outside web root.

Q: Is it urgent? (Priority Suggestion)

🔥 **Priority**: **CRITICAL**. 📈 **CVSS**: 9.8 (High). ⏳ **Action**: Patch immediately. 🚨 **Urgency**: High due to RCE risk and low exploitation barrier.

Updated May 06, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Laravel-Mediable accepts client-supplied MIME types. <br>💥 **Consequence**: Attackers upload PHP files disguised as images. <br>⚠️ **Result**: Remote Code Execution (RCE) on the server.

Q2Root Cause? (CWE/Flaw)

🛡️ **CWE**: CWE-434 (Unrestricted Upload of File with Dangerous Type). <br>🔍 **Flaw**: The package trusts the `Content-Type` header from the client instead of validating the actual file content.

Q3Who is affected? (Versions/Components)

📦 **Vendor**: Plank. <br>📦 **Product**: laravel-mediable. <br>📉 **Affected**: Versions **6.4.0 and earlier**. <br>✅ **Safe**: Version 6.4.0+ (see references).

Q4What can hackers do? (Privileges/Data)

👑 **Privileges**: Full RCE as the web server user. <br>💾 **Data**: Complete compromise of server data, database, and backend systems. <br>🔓 **Access**: No authentication required (CVSS PR:N).

Q5Is exploitation threshold high? (Auth/Config)

📉 **Threshold**: **LOW**. <br>🔑 **Auth**: None required (PR:N). <br>🎯 **Complexity**: Low (AC:L). <br>👤 **User Interaction**: None needed (UI:N). <br>🌐 **Network**: Remote (AV:N).

Q6Is there a public Exp? (PoC/Wild Exploitation)

📜 **Public Exp**: No PoC listed in data. <br>🌍 **Wild Exp**: Likely possible due to low complexity. <br>⚠️ **Risk**: High potential for automated scanning and exploitation.

Q7How to self-check? (Features/Scanning)

🔍 **Check**: Scan for `laravel-mediable` usage in `composer.json`. <br>📊 **Version**: Verify installed version is < 6.4.0. <br>📂 **Files**: Monitor uploads for PHP extensions disguised as images.

Q8Is it fixed officially? (Patch/Mitigation)

✅ **Fixed**: Yes. <br>🔧 **Patch**: Upgrade to **version 6.4.0** or later. <br>🔗 **Ref**: See GitHub Release 6.4.0 for details.

Q9What if no patch? (Workaround)

🛡️ **Workaround**: If upgrade is impossible, implement strict server-side MIME validation. <br>🚫 **Block**: Reject files with PHP extensions or non-image MIME types. <br>📂 **Store**: Move uploads outside web root.

Q10Is it urgent? (Priority Suggestion)

🔥 **Priority**: **CRITICAL**. <br>📈 **CVSS**: 9.8 (High). <br>⏳ **Action**: Patch immediately. <br>🚨 **Urgency**: High due to RCE risk and low exploitation barrier.

Continue exploring

Vulnerability detail Full AI analysis (login) plank CWE-434