Laravel-Mediable File Upload RCE via Missing .pht Blocklist

Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49972 that allows remote code execution through file upload.

The patch added phpt to the forbidden_extensions blocklist in config/mediable.php but omitted .pht, which Apache executes as PHP via the default FilesMatch directive on Debian and Ubuntu systems.

• Affected versions: 7.0.0 before 7.0.2
• An attacker can upload a .pht file that passes MediaUploader::verifyExtension() and File::sanitizeFileName() because pht is not in the blocklist
• The file is written to disk and executed as PHP when requested
• Impact: remote code execution with the privileges of the web server process