An unauthenticated remote code execution vulnerability in Plank laravel-mediable 7.0.0 through 7.0.1 allows attackers to bypass file extension filters and execute arbitrary code on the server.

This is an unrestricted file upload vulnerability (CWE-434) where an incomplete blocklist for forbidden file extensions allows attackers to upload .pht files. Because these files are not restricted by the MediaUploader or file sanitization logic, they can be uploaded and executed by the web server process as PHP code on many default Apache installations.

Successful exploitation of this vulnerability permits an unauthenticated attacker to achieve remote code execution on the underlying server. Given the CVSS score of 9.8, this represents a critical risk that could lead to full system compromise, unauthorized data access, and the potential for lateral movement within the hosting environment.

Immediate Action: Update the plank laravel-mediable package to version 7.0.2 or later immediately to include the missing .pht extension in the forbidden blocklist.

Proactive Monitoring: Monitor web server access logs for unusual file upload activity or direct requests to media directories that include .pht or other unexpected script extensions.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block file uploads with potentially dangerous extensions and restrict direct execution of files within the uploads directory via web server configuration directives.

Public Exploit Available: No (exploit_available: false)

This vulnerability presents a severe risk to infrastructure integrity. Administrators must prioritize updating to version 7.0.2 to close the identified security gap in the file extension validation logic. Failure to patch may allow attackers to gain full control over the application server.