Description
Spatie Laravel Media Library before version 11.23.0 contains a server-side request forgery vulnerability that allows remote attackers to cause the server to issue arbitrary outbound HTTP requests by passing user-controlled URLs to the addMediaFromUrl() method in InteractsWithMedia.php.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| spatie | laravel-medialibrary | < 11.23.0 | 11.23.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | spatie/laravel-medialibrary | < 11.23.0 | 11.23.0 | GHSA-fggg-964j-3j7h |
References
- laravel-medialibrary 11.23.0 Release Notes release-notes
- https://github.com/spatie/laravel-medialibrary/pull/3939 issue-tracking patch
- https://github.com/spatie/laravel-medialibrary/commit/608ea03703d3887c46434f5dda6af56de6346aba patch
- https://www.vulncheck.com/advisories/spatie-laravel-media-library-ssrf-via-addmediafromurl third-party-advisory