CVE-2025-49130: Laravel Translation Manager XSS Vulnerability

CVE-2025-49130 Overview

CVE-2025-49130 is a stored Cross-Site Scripting (XSS) vulnerability in Laravel Translation Manager, a package by barryvdh used to manage Laravel translation files. Versions prior to 0.6.8 fail to properly validate and sanitize user-supplied input rendered by the management interface. An authenticated attacker with access to the translation manager can inject arbitrary HTML and JavaScript into pages processed by other users' browsers. Successful exploitation enables session hijacking, credential theft, and unauthorized actions performed in the victim's browser context. The issue is tracked under CWE-79 and remediated in version 0.6.8.

Critical Impact
Authenticated users can inject scripts that execute in other administrators' browsers, enabling session hijacking and data theft within the Laravel administration interface.

Affected Products

barryvdh/laravel-translation-manager versions prior to 0.6.8
Laravel applications embedding the Translation Manager package
Administrative interfaces exposing the translation editor to authenticated users

Discovery Timeline

2025-06-09 - CVE-2025-49130 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49130

Vulnerability Analysis

The vulnerability originates in the controller responsible for rendering the translation management view. Configuration values and group parameters flow into the Blade view layer without strict type coercion or output encoding. An attacker with authenticated access to the translation manager can supply crafted values that persist in translation data or configuration state.

When a second administrator loads the affected view, the injected payload renders as active HTML. The browser executes attacker-controlled JavaScript within the authenticated session context. Because the payload runs under the victim's origin, it can read cookies, invoke privileged endpoints, and exfiltrate translation content or credentials.

Root Cause

The root cause is missing input validation and improper output handling on user-controlled data passed to the view. The fix in commit 527446e enforces boolean casting on the delete_enabled configuration flag before it reaches the template. Without the cast, arbitrary string values from configuration could be interpolated into rendered attributes, breaking sanitization assumptions.

Attack Vector

Exploitation requires an authenticated session with translation manager privileges and user interaction from a subsequent viewer. The attacker submits crafted values through the translation editor, which persist and render for other administrators.

php

             ->with('numTranslations', $numTranslations)
             ->with('numChanged', $numChanged)
             ->with('editUrl', $group ? action('\Barryvdh\TranslationManager\Controller@postEdit', [$group]) : null)
-            ->with('deleteEnabled', $this->manager->getConfig('delete_enabled'));
+            ->with('deleteEnabled', (bool) $this->manager->getConfig('delete_enabled'));
     }
 
     public function getView($group = null)
// Source: https://github.com/barryvdh/laravel-translation-manager/commit/527446ed419f90f2319675fc5211cb8f851d7a1f

The patch enforces (bool) casting on delete_enabled before passing it to the view, preventing tainted configuration data from reaching the rendered HTML.

Detection Methods for CVE-2025-49130

Indicators of Compromise

Translation entries or group names containing HTML tags such as <script>, <img onerror=>, or <svg> payloads
Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after loading the translation manager view
Unexpected modifications to Laravel translation files (resources/lang/*) or database-backed ltm_translations records

Detection Strategies

Audit stored translation values and group identifiers for HTML or JavaScript syntax that should not appear in localization strings
Review web server access logs for POST requests to translation manager endpoints (/translations/edit, /translations/add) containing angle brackets or event handlers
Correlate authenticated session activity in the translation manager with subsequent anomalous admin actions performed from the same session

Monitoring Recommendations

Enable a strict Content Security Policy (CSP) and log CSP violation reports from administrative pages to surface injection attempts
Monitor changes to the composer.lock file to confirm the deployed barryvdh/laravel-translation-manager version
Alert on new or unusual outbound connections from administrator workstations while translation manager views are open

How to Mitigate CVE-2025-49130

Immediate Actions Required

Upgrade barryvdh/laravel-translation-manager to version 0.6.8 or later using Composer
Restrict access to translation manager routes to trusted administrators only via middleware or role-based access control
Review existing translation entries for stored HTML or JavaScript payloads and sanitize or remove them

Patch Information

The fix is included in Laravel Translation Manager v0.6.8 via Pull Request #475. Details are documented in the GitHub Security Advisory GHSA-j226-63j7-qrqh. The remediation enforces boolean casting on configuration values and hardens sanitization of user-supplied translation data before rendering.

Workarounds

Remove or disable the translation manager routes in production environments until the upgrade is applied
Deploy a strict Content Security Policy that blocks inline scripts on administrative pages to limit XSS impact
Require multi-factor authentication on all administrator accounts with translation manager access to reduce session hijacking risk

bash

# Upgrade Laravel Translation Manager to the patched release
composer require barryvdh/laravel-translation-manager:^0.6.8
composer update barryvdh/laravel-translation-manager
php artisan view:clear
php artisan config:clear