{"action":"Upgrade plank/laravel-mediable to 7.0.0 or later.","affected":[{"fixed":"7.0.0","introduced":"0"}],"component":"plank/laravel-mediable","cve_ids":["CVE-2026-49970"],"ecosystem":"Packagist","epss":0.01026,"exploited":false,"fixed_versions":["7.0.0"],"ghsa_id":"GHSA-xv8g-76mx-2rxc","id":"tcs_01M5KFBBKDQBAH48M9W3CSHWPR","modified_at":"2026-08-13T18:51:15.975287Z","published_at":"2026-07-13T21:31:24Z","references":["https://osv.dev/vulnerability/GHSA-xv8g-76mx-2rxc","https://nvd.nist.gov/vuln/detail/CVE-2026-49970","https://github.com/plank/laravel-mediable/pull/391","https://github.com/plank/laravel-mediable/commit/6d1e7fb39922fdfb3b2d120e13f4eb2e653ae082","https://github.com/plank/laravel-mediable","https://github.com/plank/laravel-mediable/releases/tag/7.0.0","https://www.vulncheck.com/advisories/laravel-mediable-path-traversal-via-file-sanitizepath"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-xv8g-76mx-2rxc","url":"https://osv.dev/vulnerability/GHSA-xv8g-76mx-2rxc"}],"summary":"Laravel-Mediable: path traversal vulnerability in the File::sanitizePath()"}