laravel-medialibrary vulnerabilities

2 known vulnerabilities in laravel-medialibrary from Spatie. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  laravel-medialibrary: Incomplete List of Disallowed Inputs

  CVE-2026-48557May 29, 2026Spatie

  Spatie Laravel Media Library before version 11.23.0 contains a file upload restriction bypass in FileAdder::defaultSanitizer(). The sanitizer checks only the final filename suffix, allowing double-extension filenames such as shell.php.jpg to bypass the blockli

• 7.4 High severity

  laravel-medialibrary: Server-Side Request Forgery

  CVE-2026-48555May 29, 2026Spatie

  Spatie Laravel Media Library before version 11.23.0 contains a server-side request forgery vulnerability that allows remote attackers to cause the server to issue arbitrary outbound HTTP requests by passing user-controlled URLs to the addMediaFromUrl() method