nova-tiptap has Unauthenticated Arbitrary File Upload Vulnerability
The advisory, in context
A vulnerability was discovered in the marshmallow-packages/nova-tiptap Laravel Nova package that allows unauthenticated users to upload arbitrary files to any Laravel disk configured in the application.
The vulnerability is due to: • Missing authentication middleware (Nova and Nova.Auth) on the /nova-tiptap/api/file upload endpoint • Lack of validation on uploaded files (no MIME/type or extension restrictions) • Ability for an attacker to choose the disk parameter dynamically
This means an attacker can craft a custom form and send a POST request to /nova-tiptap/api/file, supplying a valid CSRF token, and upload executable or malicious files (e.g., .php, binaries) to public disks such as local, public, or s3. If a publicly accessible storage path is used (e.g. S3 with public access, or Laravel’s public disk), the attacker may gain the ability to execute or distribute arbitrary files — amounting to a potential Remote Code Execution (RCE) vector in some environments.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 5.7.0
Fixed in 5.7.0
9 explicitly affected versions
5.0.0, 5.1.0, 5.2.0, 5.2.1, 5.2.2, 5.3.0, 5.4.0, 5.5.0, 5.6.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.7.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"5.0.0",
"5.1.0",
"5.2.0",
"5.2.1",
"5.2.2",
"5.3.0",
"5.4.0",
"5.5.0",
"5.6.0"
]
}Earlier releases through 3.2.6 (inclusive)
No fix recorded for this interval.
95 explicitly affected versions
0.0.1, 0.0.2, 0.1.0, 0.1.1, 0.2.0, 0.2.1, 0.2.2, 0.3.0, 0.3.1, 0.3.2, 0.3.3, 0.3.4, 0.3.5, 0.3.6, 0.3.7, 0.3.8, 0.3.9, 0.4.0, 0.5.0, 2.6.0, v0.5.1, v0.6.0, v0.6.1, v1.0, v1.0.1, v1.1.0, v1.1.1, v1.1.2, v1.1.3, v1.2.0, v1.2.1, v1.3.0, v1.3.1, v1.3.2, v1.4.0, v1.4.1, v2.0-alpha, v2.0-beta, v2.0-beta-2, v2.0-beta-3, v2.0-beta-4, v2.0.0, v2.0.1, v2.0.2, v2.0.3, v2.1.0, v2.1.1, v2.1.2, v2.1.3, v2.1.4, v2.2.0, v2.2.1, v2.3.0, v2.3.1, v2.4.0, v2.4.1, v2.5.0, v2.5.1, v2.5.2, v2.5.3, v2.5.4, v2.6.1, v2.6.2, v2.6.3, v2.7.0, v2.7.1, v2.7.2, v2.7.3, v2.7.4, v2.7.5, v2.7.6, v2.8.0, v2.8.1, v2.8.2, v2.8.3, v2.9.0, v3.0.0, v3.0.1, v3.0.2, v3.0.3, v3.0.4, v3.0.5, v3.0.6, v3.0.7, v3.1.0, v3.1.1, v3.1.2, v3.1.3, v3.2.0, v3.2.1, v3.2.2, v3.2.3, v3.2.4, v3.2.5, v3.2.6
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.2.6"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.0.1",
"0.0.2",
"0.1.0",
"0.1.1",
"0.2.0",
"0.2.1",
"0.2.2",
"0.3.0",
"0.3.1",
"0.3.2",
"0.3.3",
"0.3.4",
"0.3.5",
"0.3.6",
"0.3.7",
"0.3.8",
"0.3.9",
"0.4.0",
"0.5.0",
"2.6.0",
"v0.5.1",
"v0.6.0",
"v0.6.1",
"v1.0",
"v1.0.1",
"v1.1.0",
"v1.1.1",
"v1.1.2",
"v1.1.3",
"v1.2.0",
"v1.2.1",
"v1.3.0",
"v1.3.1",
"v1.3.2",
"v1.4.0",
"v1.4.1",
"v2.0-alpha",
"v2.0-beta",
"v2.0-beta-2",
"v2.0-beta-3",
"v2.0-beta-4",
"v2.0.0",
"v2.0.1",
"v2.0.2",
"v2.0.3",
"v2.1.0",
"v2.1.1",
"v2.1.2",
"v2.1.3",
"v2.1.4",
"v2.2.0",
"v2.2.1",
"v2.3.0",
"v2.3.1",
"v2.4.0",
"v2.4.1",
"v2.5.0",
"v2.5.1",
"v2.5.2",
"v2.5.3",
"v2.5.4",
"v2.6.1",
"v2.6.2",
"v2.6.3",
"v2.7.0",
"v2.7.1",
"v2.7.2",
"v2.7.3",
"v2.7.4",
"v2.7.5",
"v2.7.6",
"v2.8.0",
"v2.8.1",
"v2.8.2",
"v2.8.3",
"v2.9.0",
"v3.0.0",
"v3.0.1",
"v3.0.2",
"v3.0.3",
"v3.0.4",
"v3.0.5",
"v3.0.6",
"v3.0.7",
"v3.1.0",
"v3.1.1",
"v3.1.2",
"v3.1.3",
"v3.2.0",
"v3.2.1",
"v3.2.2",
"v3.2.3",
"v3.2.4",
"v3.2.5",
"v3.2.6"
]
}