Arbitrary File Upload Affecting plank/laravel-mediable package, versions <7.0.0

Affected versions of this package are vulnerable to Arbitrary File Upload through filename sanitization in File::sanitizeFileName() and MediaUploader::useFilename()/filename inference in the upload pipeline. An attacker can upload a file named with a double extension such as shell.php.jpg while passing MIME and outer-extension checks, causing the stored filename to preserve the inner .php segment. On misconfigured Apache or nginx servers that treat any path containing .php as executable, the uploaded file is interpreted as PHP code when it is later accessed from the public drive. This lets an unauthenticated attacker run arbitrary code on the server and compromise the application and its host.

Notes

• The vulnerable path only covered the default filename sanitization flow; uploads that supply an explicit destination name via MediaUploader::useFilename() and uploads that rely on inferred filenames both passed through the same unspecialized sanitization.
• The embedded-extension bypass is relevant to deployments that blacklist executable suffixes through mediable.forbidden_file_extensions; without that list being applied to nested name segments, a double-extension like script.php.jpg could still be stored with the inner .php intact.

Workarounds

• Ensure your web server does not execute any filename containing .php as PHP, especially on Apache AddHandler setups and nginx configurations using fastcgi_split_path_info; this prevents uploaded double-extension files such as shell.php.jpg from being interpreted as executable code if they reach a public drive.
• Keep mediable.forbidden_extensions configured to include every executable extension allowed by your server, and apply MediaUploader::setForbiddenExtensions() for uploads; this blocks files with dangerous extensions from being accepted even when they are disguised with an allowed outer extension.

• GitHub Commit