Plank Laravel-Mediable Arbitrary File Upload Vulnerability Allowing Remote Code Execution

An arbitrary file upload vulnerability has been identified in Plank Laravel-Mediable versions through 6.4.0. The issue arises when an application using this package accepts or prioritizes client-supplied MIME types during file uploads. In such cases, a remote attacker could upload a file containing executable PHP code while masquerading it as a harmless image MIME type. If the uploaded file is stored in a web-accessible and executable directory, this could lead to remote code execution.

Impact

Exploitation of this vulnerability could result in arbitrary file uploads, with the potential for remote code execution if the uploaded files are placed in a web-accessible and executable location.