CVE-2026-93352 is a critical unrestricted file upload flaw (CVSS 3.1: 9.8) in Laravel-Mediable 7.0.0 up to but not including 7.0.2. It exists because an earlier fix was incomplete: the upload blocklist omits the .pht extension. Attackers can upload .pht files, and those files can run as PHP when Apache is set up to run them. The advisory says Apache's default setup on Debian and Ubuntu does this.
What Is It
The flaw is an incomplete patch for CVE-2026-49972. That earlier fix added a forbidden_extensions blocklist in config/mediable.php. The list includes phpt but leaves out pht. On Debian and Ubuntu systems, Apache's default FilesMatch directive runs .pht files as PHP.
An attacker can upload a .pht file that passes all checks in MediaUploader::verifyExtension() and File::sanitizeFileName(). The file is written to disk. On a server that runs .pht files as PHP, a request for the file runs its code. That gives the attacker remote code execution with the privileges of the web server process. Deployments whose web server does not run .pht files as PHP still accept the upload, but the file may not execute.
The weakness is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type).
Why It Matters
VulnCheck's CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That means:
- The attack works over the network.
- It has low complexity.
- It needs no privileges and no user interaction.
- Impact to confidentiality, integrity, and availability is high.
The CVSS 4.0 score is 9.3 (Critical).
The bug is also a regression risk. Teams that upgraded to fix CVE-2026-49972 may think they are protected. They can still be exposed on common Debian and Ubuntu Apache setups.
This CVE was not listed in the CISA Known Exploited Vulnerabilities catalog in the data reviewed for this brief. KEV does not currently confirm active exploitation of this CVE, and there is no KEV remediation deadline.
What's Vulnerable
- Vendor: plank
- Product: laravel-mediable (
pkg:github/plank/laravel-mediable) - Affected versions: 7.0.0 up to but not including 7.0.2 (semver)
- Exposure condition: For code execution, Apache must serve the
.phtfile and be set up to run it as PHP. The advisory names the defaultFilesMatchdirective on Debian and Ubuntu.
NVD lists the record as "Received," and no CPEs have been assigned yet.
Patch Status
The affected range ends before version 7.0.2. The references include a 7.0.2 release tag, a fix commit and pull request #396. Upgrade Laravel-Mediable to 7.0.2 or later.
Don't assume the CVE-2026-49972 fix covers this issue. Check that the installed version is 7.0.2 or later.