CVE-2026-49969 Laravel-Mediable < 7.0.0 SSRF via RemoteUrlAdapter URL Handling
Attackers can exploit unvalidated URLs in Laravel-Mediable to perform SSRF, accessing internal networks and cloud metadata to steal credentials.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-49969?
CVE-2026-49969 is a medium-severity server-side request forgery vulnerability in plank laravel-mediable, published on 13 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that allows remote attackers to issue arbitrary HTTP requests from the server by supplying unvalidated caller-controlled URLs to endpoints backed by MediaUploader::fromSource(). Attackers can craft URLs targeting RFC-1918 addresses, loopback interfaces, cloud metadata endpoints, or file:// URIs through RemoteUrlAdapter to reach internal infrastructure, retrieve sensitive files, and exfiltrate cloud credentials such as IAM tokens from instance metadata services.
Weakness: CWE-918
Which versions are affected by CVE-2026-49969?
How do I fix CVE-2026-49969?
No fix has been published for CVE-2026-49969 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-49969 being exploited?
There is no known exploitation of CVE-2026-49969 in the wild and no public exploit code.
Sources
Also known as GHSA-9fmc-j924-ghh2.