spatie has 5 CVEs on record. 2 were published in the last 90 days. The median CVSS is 6.8 (medium). None have a confirmed exploitation report. Most affected products: Scotty (2), laravel-medialibrary (2), spatie/schema-org (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.8
- Publish → KEV
- —
- Last 90 days
- 2 prev 3
Products
- Scotty 2
- laravel-medialibrary 2
- spatie/schema-org 1
Worst active — by depth score
CVE-2026-48557High· 8.8Spatie Laravel Media Library before version 11.23.0 contains a file upload restriction bypass in FileAdder::defaultSanitizer()48CVE-2026-93534Medium· 6.3A vulnerability was identified in spatie Scotty up to 1.4.247CVE-2026-93533Medium· 6.3A vulnerability was determined in spatie Scotty up to 1.4.447CVE-2026-48555High· 7.4Spatie Laravel Media Library before version 11.23.0 contains a server-side request forgery vulnerability that allows remote attackers to cause the server to issue arbitrary outbound HTTP requests by passing user-controlled URLs to the ad…41GHSA-hwmc-r6mf-jh83LowSchema.org has cross-site scripting (XSS) via script break-out in toScript() output14
spatie vulnerabilities
CVEs affecting spatie, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-93533Medium· 6.3PoCA vulnerability was determined in spatie Scotty up to 1.4.4
A vulnerability was determined in spatie Scotty up to 1.4.4. This impacts the function DoctorCommand::checkSshConnectivity/DoctorCommand::checkRemoteTools of the file app/Commands/DoctorCommand.php of the component Doctor Command Handler…
CVE-2026-93534Medium· 6.3PoCA vulnerability was identified in spatie Scotty up to 1.4.2
A vulnerability was identified in spatie Scotty up to 1.4.2. Affected is the function SelfUpdater::update of the file app/Updater/SelfUpdater.php of the component Self Update Handler. Such manipulation leads to download of code without i…
GHSA-hwmc-r6mf-jh83LowSchema.org has cross-site scripting (XSS) via script break-out in toScript() output
Schema.org has cross-site scripting (XSS) via script break-out in toScript() output
CVE-2026-48557High· 8.8Spatie Laravel Media Library before version 11.23.0 contains a file upload restriction bypass in FileAdder::defaultSanitizer()
Spatie Laravel Media Library before version 11.23.0 contains a file upload restriction bypass in FileAdder::defaultSanitizer(). The sanitizer checks only the final filename suffix, allowing double-extension filenames such as shell.php.jp…
CVE-2026-48555High· 7.4Spatie Laravel Media Library before version 11.23.0 contains a server-side request forgery vulnerability that allows remote attackers to cause the server to issue arbitrary outbound HTTP requests by passing user-controlled URLs to the ad…
Spatie Laravel Media Library before version 11.23.0 contains a server-side request forgery vulnerability that allows remote attackers to cause the server to issue arbitrary outbound HTTP requests by passing user-controlled URLs to the ad…