Laravel-Mediable
CVE-2026-49971
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network upload path needs no auth (PR:N); victim must open SVG (UI:R); XSS changes scope to victim browser (S:C) with limited cookie/CSRF impact (C:L/I:L).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Laravel-Mediable before 7.0.0 contains a stored cross-site scripting vulnerability that allows authenticated or anonymous users to execute arbitrary JavaScript by uploading unsanitized SVG files containing embedded scripts in onload event handlers, script tags, or foreignObject elements. Attackers can store persistent XSS payloads in uploaded SVG files that execute with full DOM access when victims open or preview the file, enabling session cookie theft, CSRF token capture, and account takeover.
AnalysisAI
Stored XSS in Laravel-Mediable before 7.0.0 allows network-accessible, unauthenticated attackers to persist malicious JavaScript payloads by uploading crafted SVG files containing embedded scripts in onload handlers, script tags, or foreignObject elements. When any authenticated user subsequently opens or previews a poisoned file in their browser, the payload executes with full DOM access, enabling session cookie theft, CSRF token capture, and complete account takeover. No public exploit has been identified at time of analysis, but the attack requires no special privileges and the technique is well-understood; the vendor has classified this as a security release and strongly recommends immediate upgrade to 7.0.0.
Technical ContextAI
Laravel-Mediable is a PHP package for the Laravel web framework that manages file uploads, storage, and media associations. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the failure to sanitize SVG image content prior to storage. SVG is an XML-based vector format natively executable by browsers: it supports inline JavaScript via <script> elements, event attributes such as onload on the root <svg> element, and script injection through <foreignObject> embedding. When an application stores and subsequently serves user-supplied SVGs directly to browsers without content-stripping, any embedded scripts execute in the document's origin context. The CPE string cpe:2.3:a:plank:laravel-mediable:*:*:*:*:*:*:*:* indicates all versions prior to 7.0.0 are affected. The patch in 7.0.0 introduces a SvgSanitizer class implementing a new SanitizerInterface, which is applied by default to all image/svg+xml uploads and rewrites SVG content to strip executable JavaScript before the file is stored.
RemediationAI
Upgrade Laravel-Mediable to version 7.0.0, which the vendor has explicitly designated a security release and for which upgrade is strongly recommended. This version adds SvgSanitizer as the default sanitizer for all image/svg+xml uploads, stripping executable JavaScript and other untrusted content before storage; it is enabled by default and can be controlled via the new mediable.file_sanitizers configuration key. If immediate upgrade is not possible, the most effective compensating control is to disable SVG upload entirely by adding svg and image/svg+xml to the application's forbidden file extensions and MIME type blocklist, accepting the trade-off that legitimate SVG uploads will be rejected. A weaker but non-breaking alternative is to configure the web server (nginx or Apache) to serve SVG files with a Content-Disposition: attachment header, forcing download rather than inline rendering and preventing script execution in the browser - note this may break image preview functionality. Do not rely on MIME type sniffing or client-side filtering alone, as browsers will execute embedded scripts in any SVG rendered inline regardless of declared content type. The advisory and patch are at https://github.com/plank/laravel-mediable/releases/tag/7.0.0.
More in Laravel Mediable
View allArbitrary file write in the Plank Laravel-Mediable package (before 7.0.0) lets an attacker who influences the destinatio
Remote code execution in the plank/laravel-mediable package before 7.0.0 lets attackers upload a double-extension file s
Server-side request forgery in Laravel-Mediable before 7.0.0 enables network-accessible, low-privilege attackers to issu
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today