CVE-2026-93352: Laravel-Mediable 7.0.0 < 7.0.2 RCE via .pht File Upload
Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49972 in which the .pht extension is absent from the forbiddenextensions blocklist in config/mediable.php. The blocklist introduced to address CVE-2026-49972 includes phpt but omits pht, which Apache executes as PHP via the default FilesMatch directive on Debian and Ubuntu systems. An attacker can upload a .pht file that passes all validation in MediaUploader::verifyExtension() and File::sanitizeFileName() because pht is not present in the blocklist, causing the file to be written to disk and executed as PHP when requested, enabling remote code execution with the privileges of the web server process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Laravel-Mediableto a version that resolves this vulnerability.Fixed in 7.0.2 - Configuration
Add the pht extension to the forbidden_extensions blocklist in config/mediable.php.
Laravel-Mediable forbidden_extensions = include pht
Event History
Frequently Asked Questions
Which deployments are realistically exposed to code execution?
Deployments using Laravel-Mediable 7.0.0 or 7.0.1 are exposed where attackers can reach an upload path handled by the affected package and uploaded files can later be requested through Apache. The described execution behavior specifically applies to Debian and Ubuntu Apache configurations whose default FilesMatch directive treats .pht files as PHP.
What does an attacker need to exploit this issue?
The attacker needs no authentication or user interaction if they can access a vulnerable file-upload function. They must upload a file with a .pht extension and cause the uploaded file to be requested, at which point Apache executes it as the web server process.
How can I determine whether an installation is affected?
Check whether the application uses packagist/plank/laravel-mediable version 7.0.0 or 7.0.1. Also inspect config/mediable.php: an affected forbidden_extensions blocklist includes phpt but does not include pht.
What should be done if an immediate upgrade is not possible?
Add pht to the forbidden_extensions blocklist in config/mediable.php and prevent uploaded files from being executed by Apache. Review previously uploaded files for .pht files, since any such file that is web-accessible may execute when requested.