Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

spatie/laravel-medialibrary

              main @ 1185f3e
            

Fixes

CVEs

CRITICAL

Peak severity

80.0%

Coverage

Highlights

Arbitrary File Upload: 1 prior fix. Scrutinize any change in this area.

src/MediaCollections/FileAdder.php: most-fixed (2 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: Attackers can bypass upload filters using multi-extension files (e.g., shell.php.jpg) to write executable code on servers running legacy handler configurations. The fix enforces a strict per-segment check on all parts of the split filename.

Arbitrary File Upload: Unrestricted file writes to the underlying storage occur when PHP executable extensions are not properly blocked during the file addition lifecycle. Implementing a comprehensive blocklist prevents direct code execution.

Path Traversal: User-defined zip filename prefixes containing directory traversal segments ('.' or '..') can escape target directories during zip archive construction. Sanity checks are required to strip these invalid path segments.