Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading a file with an embedded PHP extension disguised within a double extension such as shell.php.jpg. The PATHINFO_FILENAME extraction preserves the inner .php extension in the base name, and on misconfigured Apache or nginx servers that execute any filename containing .php as PHP, the stored file is interpreted as executable code while all MIME type, extension, and aggregate type validation checks pass due to the outer .jpg extension.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-13 | 1 | General1 |
| 2026-07-14 | 2 | Disclosure1Patch1 |
| 2026-09-02 | 1 | Disclosure1 |
| 2026-09-24 | 1 | Disclosure1 |
CVE-2026-49972: Laravel-Mediable <7.0.0 lets you upload shell.php.jpg and get RCE. Here's the 4-step chain and what to check Today.
Post summary
The post announces a new RCE vulnerability in Laravel‑Mediable (CVE‑2026‑49972), detailing how the flaw can be triggered via a specially crafted upload, but offers no PoC code, exploits, patches, or evidence of active exploitation.
CVE-2026-93352 Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49972 in which the .pht extension is absent from the forbidden_extensions blocklist in c… https://www.cve.org/CVERecord?id=CVE-2026-93352
Post summary
The tweet discloses CVE-2026-93352 and provides a technical detail about an incomplete patch configuration (missing .pht extension in a blocklist) for Laravel-Mediable, but contains no PoC, exploit tool, active exploitation claims, or named remediation action.
CVE-2026-49972: shell.php.jpg can pass upload checks: but become dangerous when a server executes anything containing .php. Validation is half the job. Server configuration is the other half. #Laravel https://t.co/2EHiLf73z2
Post summary
The tweet discloses that CVE‑2026‑49972 allows a malicious shell.php.jpg file to pass upload validations and, if executed, can run PHP code on the server – underscoring the need for proper file validation and server configuration.
Laravel-Mediable before 7․0․0 allows remote code exec via double extension file uploads, fixed in 7․0․0; CVE-2026-49972, CVSS 7․7 https://ift.tt/g1Q9FKe
Post summary
The snippet announces a remote code execution flaw in Laravel-Mediable before 7.0.0 (CVE‑2026‑49972, CVSS 7.7), notes it is fixed in 7.0.0, but provides no PoC or exploit details.
CVE-2026-49972 Remote Code Execution in Laravel-Mediable Before 7.0.0 via Double Extension File Upload https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-49972
Post summary
The text provides minimal details about CVE‑2026‑49972, listing its type and affected versions, but lacks evidence of an exploit, PoC, patch, or active exploitation.