Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Spatie Laravel Media Library before version 11.23.0 contains a file upload restriction bypass in FileAdder::defaultSanitizer(). The sanitizer checks only the final filename suffix, allowing double-extension filenames such as shell.php.jpg to bypass the blocklist, with pathinfo() preserving inner .php stems in saved filenames. The blocklist also omits executable extensions including .php6, .shtml, and .htaccess. The double-extension bypass requires a legacy Apache AddHandler configuration to achieve PHP execution; the incomplete blocklist bypass does not.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-48557 File Upload Restriction Bypass in Spatie Laravel Media Library Before 11.23.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-48557
Post summary
The entry references the CVE-2026-48557, noting a file‑upload restriction bypass in Spatie Laravel Media Library versions prior to 11.23.0, but offers minimal technical detail or actionable information.