CVE-2026-49970— plank laravel-mediable 路径遍历漏洞

Laravel-Mediable < 7.0.0 Path Traversal via File::sanitizePath()

Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath() function that allows attackers to write uploaded files to arbitrary locations by controlling the directory argument passed to MediaUploader::toDestination(). Attackers can exploit the permissive character-class regex that allows both dot and slash characters combined with an ineffective trailing trim() call to bypass sanitization and upload files to sensitive locations such as the document root, environment configuration files, or application configuration directories, enabling remote code execution.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

对路径名的限制不恰当(路径遍历)

plank laravel-mediable 路径遍历漏洞

Plank Laravel-Mediable是Plank个人开发者开源的一个Laravel媒体文件管理包。 Plank laravel-mediable 7.0.0之前版本存在路径遍历漏洞，该漏洞源于File::sanitizePath()函数存在路径遍历问题，允许攻击者通过控制传递给MediaUploader::toDestination()的目录参数，将上传的文件写入任意位置。攻击者可利用允许点和斜杠字符的宽松字符类正则表达式，结合无效的尾部trim()调用来绕过清理，将文件上传到文档根目录、环境配置

N/A

N/A