CVE-2026-4809 Unsafe Client MIME Type Handling Can Enable Arbitrary File Upload in plank/laravel-mediable
Attackers can upload executable PHP files by spoofing MIME types if the application trusts client-supplied MIME types, leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-4809?
CVE-2026-4809 is a critical vulnerability in plank laravel-mediable, published on 26 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
plank/laravel-mediable through version 6.4.0 can allow upload of a dangerous file type when an application using the package accepts or prefers a client-supplied MIME type during file upload handling. In that configuration, a remote attacker can submit a file containing executable PHP code while declaring a benign image MIME type, resulting in arbitrary file upload.
Weakness: CWE-434
Which versions are affected by CVE-2026-4809?
How do I fix CVE-2026-4809?
No fix has been published for CVE-2026-4809 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-4809 being exploited?
There is no known exploitation of CVE-2026-4809 in the wild and no public exploit code.
Sources
Also known as GHSA-2w6q-cfjg-6mjp.