Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that allows remote attackers to issue arbitrary HTTP requests from the server by supplying unvalidated caller-controlled URLs to endpoints backed by MediaUploader::fromSource(). Attackers can craft URLs targeting RFC-1918 addresses, loopback interfaces, cloud metadata endpoints, or file:// URIs through RemoteUrlAdapter to reach internal infrastructure, retrieve sensitive files, and exfiltrate cloud credentials such as IAM tokens from instance metadata services.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
CVE-2026-49969 Server-Side Request Forgery in Laravel-Mediable Before 7.0.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-49969
Post summary
A Server‑Side Request Forgery vulnerability (CVE‑2026‑49969) affecting Laravel‑Mediable versions earlier than 7.0.0 has been disclosed, but no PoC, exploit, active exploitation, or patch information was provided.
🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-49969](https://github.com/plank/laravel-mediable/commit/7e9e3000fa05fe16e678f15bfb51a09... https://github.com/plank/laravel-mediable/commit/7e9e3000fa05fe16e678f15bfb51a091e60c2cb8 #CVE #ZeroDay #PatchManagement
Post summary
A GitHub commit link is shared, indicating a patch is available for CVE‑2026‑49969, but no exploit or technical details of the vulnerability are provided.