CVE-2026-48555CWE-918ssrf

CVE-2026-48555

High · published May 30, 2026

CVSS v3.1
7.4
EPSS
0%
Percentile
35.5
In the wild
Unconfirmed
What it is

Spatie Laravel Media Library before version 11.23.0 contains a server-side request forgery vulnerability that allows remote attackers to cause the server to issue arbitrary outbound HTTP requests by passing user-controlled URLs to the addMediaFromUrl() method in InteractsWithMedia.php.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00423 · 35.5th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-05-30T00:16Z
References (4)
https://github.com/spatie/laravel-medialibrary/commit/608ea03703d3887c46434f5dda6af56de6346aba · [email protected]https://github.com/spatie/laravel-medialibrary/pull/3939 · [email protected]https://github.com/spatie/laravel-medialibrary/releases/tag/11.23.0 · [email protected]https://www.vulncheck.com/advisories/spatie-laravel-media-library-ssrf-via-addmediafromurl · [email protected]
EPSS history
Timeline
  • 29 MAY 18:30Z
    Spatie Laravel Media Library < 11.23.0 SSRF via addMediaFromUrl()
    cvelistv5