PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-48555 spatie CVE debrief

A server-side request forgery (SSRF) vulnerability exists in Spatie Laravel Media Library before version 11.23.0. The `addMediaFromUrl()` method in `InteractsWithMedia.php` accepts user-controlled URLs without adequate validation, allowing remote attackers to induce the server to issue arbitrary outbound HTTP requests. This can enable unauthorized access to internal services, cloud metadata endpoints, or other restricted network resources. The vulnerability was disclosed to the vendor and resolved in version 11.23.0 via a pull request that implemented URL validation controls. Organizations using affected versions should upgrade immediately and review application logic for any custom URL handling that may bypass protections.

Vendor
spatie
Product
laravel-medialibrary
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-29
Original CVE updated
2026-07-22
Advisory published
2026-05-29
Advisory updated
2026-07-22

Who should care

Organizations running Laravel applications with Spatie Laravel Media Library versions below 11.23.0, particularly those exposing media upload functionality to untrusted users or operating in cloud environments where metadata service access poses elevated risk.

Technical summary

The `addMediaFromUrl()` method in Spatie Laravel Media Library's `InteractsWithMedia` trait processes user-supplied URLs to fetch remote media. In versions prior to 11.23.0, insufficient URL validation permits attackers to supply crafted URLs targeting internal network addresses, cloud metadata services (e.g., 169.254.169.254), or other restricted endpoints. The server executes these requests with its own network privileges, potentially exposing sensitive data or enabling further lateral movement. The fix in 11.23.0 introduces validation to restrict allowable URL schemes and destinations.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Spatie Laravel Media Library to version 11.23.0 or later
  • Review application code for direct calls to addMediaFromUrl() with user-supplied input
  • Implement network egress filtering to restrict server outbound connectivity
  • Audit access logs for anomalous outbound HTTP requests from application servers
  • Consider additional URL validation layers for media import functionality if custom wrappers exist

Evidence notes

Vulnerability confirmed via vendor commit and release notes. CVSS 4.0 vector indicates network attack vector with low attack complexity, requiring low privileges but no user interaction. CWE-918 (Server-Side Request Forgery) classified as primary weakness. No known exploitation in the wild or ransomware campaign use documented at time of disclosure.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-48555 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-48555

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-48555 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-48555

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.