CVE-2026-49969
High
Description
Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that allows remote attackers to issue arbitrary HTTP requests from the server by supplying unvalidated caller-controlled URLs to endpoints backed by MediaUploader::fromSource(). Attackers can craft URLs targeting RFC-1918 addresses, loopback interfaces, cloud metadata endpoints, or file:// URIs through RemoteUrlAdapter to reach internal infrastructure, retrieve sensitive files, and exfiltrate cloud credentials such as IAM tokens from instance metadata services.
SeverityHigh
CVSS7.4
Exploit probability—
ProductPlank Laravel-mediable
PublishedJul 13, 2026
First seenJul 13, 2026
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Update
- plank laravel-mediable7.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| plank laravel-mediable | v < 7.0.0 | 7.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.