Xurshidbek Sobirjonov

**Name of the Vulnerable Software and Affected Versions** Laravel-Mediable versions prior to 7.0.0 **Description** An issue allows remote attackers to issue arbitrary HTTP requests from the server by providing unvalidated URLs to endpoints that use the `MediaUploader::fromSource()` function. Through the `RemoteUrlAdapter`, attackers can target RFC-1918 addresses (private IP addresses used in local networks), loopback interfaces, cloud metadata endpoints, or `file://` URIs. This can lead to access to internal infrastructure, retrieval of sensitive files, and exfiltration of cloud credentials, such as IAM tokens from instance metadata services. **Recommendations** Update Laravel-Mediable to version 7.0.0 or later.

**Name of the Vulnerable Software and Affected Versions** Laravel-Mediable versions prior to 7.0.0 **Description** An issue exists in the `File::sanitizePath()` function that allows attackers to write uploaded files to arbitrary locations. This is possible by controlling the directory argument passed to `MediaUploader::toDestination()`. The flaw stems from a permissive character-class regex that allows both dot and slash characters, combined with an ineffective trailing `trim()` call, which bypasses sanitization. This can lead to files being uploaded to sensitive locations such as the document root, environment configuration files, or application configuration directories, potentially enabling remote code execution. **Recommendations** Update Laravel-Mediable to version 7.0.0 or later.

**Name of the Vulnerable Software and Affected Versions** Laravel-Mediable versions prior to 7.0.0 **Description** Stored cross-site scripting occurs when authenticated or anonymous users upload unsanitized SVG files containing embedded scripts in `onload` event handlers, `script` tags, or `foreignObject` elements. These persistent payloads execute with full DOM access when a victim opens or previews the file, which can lead to session cookie theft, CSRF token capture, and account takeover. **Recommendations** Update Laravel-Mediable to version 7.0.0 or later.

**Name of the Vulnerable Software and Affected Versions** Laravel-Mediable versions prior to 7.0.0 **Description** An issue exists where unauthenticated attackers can achieve remote code execution by uploading files with double extensions, such as `shell.php.jpg`. The `PATHINFO FILENAME` extraction preserves the inner `.php` extension in the base name. On misconfigured Apache or nginx servers that execute any filename containing `.php` as PHP, the stored file is interpreted as executable code. This occurs because the outer `.jpg` extension allows the file to bypass MIME type, extension, and aggregate type validation checks. **Recommendations** Update Laravel-Mediable to version 7.0.0 or later.

**Name of the Vulnerable Software and Affected Versions** Linux-PAM versions prior to 1.7.3 **Description** A timing discrepancy exists in the `pam userdb` module's plaintext-password comparison path within `modules/pam userdb/pam userdb.c`. A local or network-adjacent attacker can recover the plaintext password of a target account by measuring response-timing differences when repeatedly driving authentication through a calling service. The issue occurs because the comparison uses `strncmp()` (or `strncasecmp()` when `PAM ICASE ARG` is set) after a length-equality check, causing the rejection time to depend on the password length and the index of the first differing byte. This path is triggered when the administrator configures `pam userdb` with `crypt=none`, an unrecognized crypt method, or without a `crypt=` argument, leading the module to store and compare credentials in plaintext. **Recommendations** Update to a version later than 1.7.2. Avoid configuring `pam userdb` with `crypt=none`, an unrecognized crypt method, or without a `crypt=` argument to prevent the use of plaintext password comparisons.

**Name of the Vulnerable Software and Affected Versions** Spatie Laravel Media Library versions prior to 11.23.0 **Description** A file upload restriction bypass exists in the `defaultSanitizer()` function of the `FileAdder` class. The sanitizer only validates the final filename suffix, which allows files with double extensions, such as shell.php.jpg, to bypass the blocklist because `pathinfo()` preserves inner stems in the saved filenames. Additionally, the blocklist fails to include several executable extensions, such as `.php6`, `.shtml`, and `.htaccess`. While the double-extension bypass requires a legacy Apache AddHandler configuration to execute PHP, the bypass involving the incomplete blocklist does not. **Recommendations** Update to version 11.23.0 or later.

**Name of the Vulnerable Software and Affected Versions** Spatie Laravel Media Library versions prior to 11.23.0 **Description** An issue exists that allows remote attackers to cause the server to issue arbitrary outbound HTTP requests. This occurs when user-controlled URLs are passed to the `addMediaFromUrl()` function within the InteractsWithMedia.php file. This is a server-side request forgery, which is a flaw where an attacker can force a server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing. **Recommendations** Update to version 11.23.0 or later. As a temporary workaround, restrict or validate user-controlled URLs passed to the `addMediaFromUrl()` function.