CVE-2026-49971
Laravel-Mediable < 7.0.0 Stored XSS via SVG File Upload
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jul 13, 2026
- Updated
- Jul 14, 2026
- Reserved
- Jun 2, 2026
Description
Laravel-Mediable before 7.0.0 contains a stored cross-site scripting vulnerability that allows authenticated or anonymous users to execute arbitrary JavaScript by uploading unsanitized SVG files containing embedded scripts in onload event handlers, script tags, or foreignObject elements. Attackers can store persistent XSS payloads in uploaded SVG files that execute with full DOM access when victims open or preview the file, enabling session cookie theft, CSRF token capture, and account takeover.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 6.1 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
laravel-mediableplank |
|
References
- laravel-mediable 7.0.0 Release Notesrelease-notespatch
- Patch Commitpatch
- https://www.vulncheck.com/advisories/laravel-mediable-stored-xss-via-svg-file-uploadthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.