CVE-2026-49971
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Laravel-Mediable before version 7.0.0 contains a stored cross-site scripting vulnerability that allows authenticated or anonymous users to execute arbitrary JavaScript by uploading unsanitized SVG files containing embedded scripts in onload event handlers, script tags, or foreignObject elements.
Risk Assessment
Attackers can store persistent XSS payloads in uploaded SVG files that execute with full DOM access when victims open or preview the file, enabling session cookie theft, CSRF token capture, and account takeover.
Recommendation
Immediately upgrade Laravel-Mediable to version 7.0.0 or later and implement validation and sanitization of uploaded SVG files, blocking dangerous elements and attributes.
Other vulnerabilities in Laravel-Mediable
See all- CVE-2026-49972High
A file upload vulnerability in Laravel-Mediable before version 7.0.0 allows unauthenticated attackers to achieve remote code execution by uploading a file with a double extension like shell.php.jpg. The PATHINFO_FILENAME extraction preserves the inner .php extension, and on misconfigured Apache or nginx servers, the file is executed as PHP while MIME and extension validation pass due to the outer .jpg.
- CVE-2026-49970High
A path traversal vulnerability was discovered in the Laravel-Mediable library before version 7.0.0 in the File::sanitizePath() function. It allows attackers to write uploaded files to arbitrary locations by controlling the directory argument passed to MediaUploader::toDestination().
- CVE-2026-49969High
Laravel-Mediable before version 7.0.0 contains a server-side request forgery (SSRF) vulnerability. It allows remote attackers to issue arbitrary HTTP requests from the server by supplying unvalidated caller-controlled URLs to endpoints backed by MediaUploader::fromSource().
Original NVD description (English source)
Laravel-Mediable before 7.0.0 contains a stored cross-site scripting vulnerability that allows authenticated or anonymous users to execute arbitrary JavaScript by uploading unsanitized SVG files containing embedded scripts in onload event handlers, script tags, or foreignObject elements. Attackers can store persistent XSS payloads in uploaded SVG files that execute with full DOM access when victims open or preview the file, enabling session cookie theft, CSRF token capture, and account takeover.