CERT24CVE-2026-93352: Unrestricted Upload of a File with a Dangerous Type in Laravel-MediableLoading data…
CERT24Threat Observatory
Period

CVE-2026-93352: Unrestricted Upload of a File with a Dangerous Type in Laravel-Mediable

Laravel-Mediable versions 7.0.0 before 7.0.2 contain an incomplete patch for CVE-2026-49972. The .pht extension is absent from the forbidden-extension list, allowing an attacker to upload a .pht file that Apache executes as PHP by default on Debian and Ubuntu.

← Back to intelligence

CVE-2026-93352: Unrestricted Upload of a File with a Dangerous Type in Laravel-Mediable

Laravel-Mediable versions 7.0.0 before 7.0.2 contain an incomplete patch for CVE-2026-49972. The .pht extension is absent from the forbidden-extension list, allowing an attacker to upload a .pht file that Apache executes as PHP by default on Debian and Ubuntu.