Plank vulnerabilities
We track 5 vulnerabilities in Plank products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on September 23, 2026.
Latest Plank vulnerabilities
- 9.8 Critical severity
laravel-mediable: Unrestricted Upload of File with Dangerous Type
Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49972 in which the .pht extension is absent from the forbidden_extensions blocklist in config/mediable.php. The blocklist introduced to address CVE-2026-49972 includes phpt but omits
- 8.8 High severity
laravel-mediable: Unrestricted Upload of File with Dangerous Type
Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading a file with an embedded PHP extension disguised within a double extension such as shell.php.jpg. The PATHINFO
- 8.8 High severity
laravel-mediable: Improper Limitation of a Pathname to a Restricted Directory
Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath() function that allows attackers to write uploaded files to arbitrary locations by controlling the directory argument passed to MediaUploader::toDestination(). Atta
- 7.4 High severity
laravel-mediable: Server-Side Request Forgery
Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that allows remote attackers to issue arbitrary HTTP requests from the server by supplying unvalidated caller-controlled URLs to endpoints backed by MediaUploader::fromSource().
- 9.8 Critical severity
laravel-mediable: Unrestricted Upload of File with Dangerous Type
plank/laravel-mediable through version 6.4.0 can allow upload of a dangerous file type when an application using the package accepts or prefers a client-supplied MIME type during file upload handling. In that configuration, a remote attacker can submit a file