CVE-2026-49969: Laravel-Mediable < 7.0.0 SSRF via RemoteUrlAdapter URL Handling
Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that allows remote attackers to issue arbitrary HTTP requests from the server by supplying unvalidated caller-controlled URLs to endpoints backed by MediaUploader::fromSource(). Attackers can craft URLs targeting RFC-1918 addresses, loopback interfaces, cloud metadata endpoints, or file:// URIs through RemoteUrlAdapter to reach internal infrastructure, retrieve sensitive files, and exfiltrate cloud credentials such as IAM tokens from instance metadata services.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49969?
The severity of CVE-2026-49969 is high, rated at 7.4 on the CVSS scale.
How do I fix CVE-2026-49969?
To fix CVE-2026-49969, you should upgrade Laravel-Mediable to version 7.0.0 or later.
What does CVE-2026-49969 exploit?
CVE-2026-49969 exploits a server-side request forgery vulnerability in Laravel-Mediable, allowing attackers to make arbitrary HTTP requests.
What systems are affected by CVE-2026-49969?
CVE-2026-49969 affects Laravel-Mediable versions prior to 7.0.0.
What types of attacks can CVE-2026-49969 enable?
CVE-2026-49969 can enable remote attackers to issue arbitrary HTTP requests from the server.