← Back to the live CVE advisory feed

CVE-2026-93352: Product identification pending

Severity

9.3 (CRITICAL)

Vendor

LARAVEL-MEDIABLE

Affected versions

7.0.0 before 7.0.2

Fixed version

7.0.2

Patch status

Patched

Published

2026-09-23T22:16:59.523

Modified

2026-09-23T22:16:59.523

Why it matters

This matters because the affected product may allow remote code execution with web server privileges, making vulnerable systems highly susceptible to compromise. Prioritize systems that are internet-facing or have privileged access to other infrastructure.

Recommended admin actions

• Upgrade Laravel-Mediable to version 7.0.2 or later immediately.
• Identify all instances of Laravel-Mediable 7.0.0 through 7.0.1 within your environment.
• Prioritize patching for internet-facing systems.
• Review web server logs for suspicious uploads of '.pht' files.

Technical summary

Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49972 in which the .pht extension is absent from the forbidden_extensions blocklist in config/mediable.php. The blocklist introduced to address CVE-2026-49972 includes phpt but omits pht, which Apache executes as PHP via the default FilesMatch directive on Debian and Ubuntu systems. An attacker can upload a .pht file that passes all validation in MediaUploader::verifyExtension() and File::sanitizeFileName() because pht is not present in the blocklist, causing the file to be written to disk and executed as PHP when requested, enabling remote code execution with the privileges of the web server process.

View the official NVD record for CVE-2026-93352

AI-enriched (MEDIUM confidence). Validate against the vendor advisory before taking production action.