laravel-mediable CVE-2026-93352: Incomplete Patch for CVE-2026-49972 Opens RCE via .pht Uploads

TL;DR — 90 seconds

laravel-mediable handles file uploads in Laravel applications. The predecessor flaw CVE-2026-49972 allowed uploading executable files; the patch added the extension phpt to the blocklist in config/mediable.php, but left pht unaddressed. Since Apache on Debian and Ubuntu treats .pht files as PHP by default, an upload with that extension is enough for remote code execution. Affected are versions 7.0.0 and 7.0.1, fixed in version 7.0.2, which adds pht to the blocklist.

What is the problem?

laravel-mediable is a widely used Composer package for file and media uploads in Laravel applications. The predecessor flaw CVE-2026-49972 allowed uploading files with executable extensions by bypassing extension validation. The first patch responded with a forbidden_extensions blocklist in config/mediable.php, adding, among others, phpt.

The extension pht was overlooked in the process. On Debian and Ubuntu, Apache's bundled FilesMatch directive runs files with the .pht extension as PHP by default, in addition to the well-known .php and .phtml extensions. A file with the .pht extension containing PHP code passes both MediaUploader::verifyExtension() and File::sanitizeFileName(), since pht isn't on the blocklist.

Once the file lands in a publicly reachable upload directory, a subsequent HTTP request to it executes the contained PHP code with the privileges of the web server process.

Who is affected?

Concretely affected are Laravel applications running laravel-mediable 7.0.0 or 7.0.1, exposing a file upload endpoint through the package, and running on an Apache web server on Debian or Ubuntu with default configuration. Whether the upload endpoint requires authentication depends on the application; the package itself doesn't mandate authentication.

Impact

A successful attack leads to full remote code execution with the privileges of the web server process. That typically brings read access to application code and configuration, access to database credentials, and the ability to load further malware or permanently compromise the application.

The risk is particularly high because exploitation requires no knowledge of internal structures: an upload endpoint, a default Apache install on Debian or Ubuntu, and an outdated package version are enough. Publicly reachable upload features, such as for profile pictures, documents, or support attachments, are typical attack surfaces.

Mitigation / immediate actions

Update laravel-mediable to version 7.0.2 or later:

composer require plank/laravel-mediable:^7.0.2
php artisan config:clear
php artisan cache:clear

Regardless of the package update, also add your own conservative blocklist in config/mediable.php instead of relying solely on the package's default configuration:

'forbidden_extensions' => [
    'php', 'phtml', 'phar', 'pht', 'phpt', 'php3', 'php4', 'php5', 'php7', 'phps',
],

Also harden the Apache configuration for upload directories instead of relying on the application layer alone:

# In an .htaccess or vhost configuration for the upload directory
<FilesMatch "\.(php|phtml|pht|phps|phar)$">
    Require all denied
</FilesMatch>

Also remove script execution for the upload directory entirely where possible, for example via a separate storage domain with no PHP handler.

Detection / verification

Review your upload directories and access logs for indicators:

# Look for uploaded .pht files
find storage/app/public -iname '*.pht'
find public/uploads -iname '*.pht' 2>/dev/null

# POST requests with .pht filenames in the access log
grep -i '\.pht' access.log | grep -i 'POST'

# Subsequent GET requests to .pht files, especially shortly after an upload
grep -i '\.pht' access.log | grep -i 'GET'

Also check the installed package version:

composer show plank/laravel-mediable | grep versions

If you find an already-uploaded .pht file, assume compromise and review application code, database credentials, and server processes for further changes.

Operator recommendation

Act today if: you run laravel-mediable 7.0.0 or 7.0.1, expose a publicly reachable upload endpoint through the package, and run Apache on Debian or Ubuntu without your own .pht blocking. Update to 7.0.2 immediately and check upload directories for already-placed .pht files.

Monitoring is enough if: you have already updated to 7.0.2, or your upload directories are already server-side hardened against script execution, for example via a separate storage domain. Reviewing the detection guidance for the period before the update is still worthwhile.

Conclusion

CVE-2026-93352 shows a familiar pattern with file-upload blocklists: an incomplete list of forbidden extensions is only as safe as its weakest gap, and default web server configurations often recognize more executable extensions than application developers have on their radar. Anyone offering file uploads should harden server configuration in addition to the application layer, rather than relying on a blocklist alone.

Sources

• OSV: CVE-2026-93352
• TheHackerWire: CVE-2026-93352 Laravel-Mediable Incomplete Patch Enables Critical RCE via .pht File Upload
• plank/laravel-mediable on GitHub