CVE-2026-49971: Laravel-Mediable Stored XSS Vulnerability

CVE-2026-49971 Overview

CVE-2026-49971 is a stored cross-site scripting (XSS) vulnerability in the Laravel-Mediable package before version 7.0.0. The package fails to sanitize uploaded Scalable Vector Graphics (SVG) files, allowing attackers to embed JavaScript inside onload handlers, <script> tags, or <foreignObject> elements. When a victim opens or previews an uploaded SVG, the payload executes in the browser with full Document Object Model (DOM) access. Successful exploitation enables session cookie theft, Cross-Site Request Forgery (CSRF) token capture, and account takeover. The flaw is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Persistent JavaScript execution in the context of any user who views a malicious SVG, leading to session hijacking and account takeover.

Affected Products

Plank Laravel-Mediable package versions prior to 7.0.0
Laravel applications that accept SVG uploads through Laravel-Mediable
Downstream applications using Laravel-Mediable for media management

Discovery Timeline

2026-07-13 - CVE-2026-49971 published to the National Vulnerability Database (NVD)
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-49971

Vulnerability Analysis

Laravel-Mediable accepts SVG files as image uploads without applying sanitization. SVG is an Extensible Markup Language (XML) based format that supports embedded scripting constructs. When the package stores an attacker-controlled SVG and later serves it inline through a browser, the browser parses and executes any embedded JavaScript.

The payload executes in the origin of the hosting application. This grants the attacker access to cookies, localStorage, and any CSRF tokens rendered in the page. Attackers can pivot from a single upload into authenticated actions on behalf of the victim.

The vulnerability is stored rather than reflected, meaning the payload persists in application storage until removed. Any user viewing the file triggers execution, making the flaw effective against both anonymous visitors and privileged administrators previewing uploaded media.

Root Cause

The upload pipeline in Laravel-Mediable before 7.0.0 lacked a configurable file sanitizer stage. SVG content passed through the media handler unchanged, preserving script tags, event handlers, and foreign objects that browsers interpret as executable code.

Attack Vector

An attacker with the ability to upload media (authenticated or anonymous, depending on application configuration) submits an SVG file containing JavaScript. The file is stored and served by the application. Any user who opens the file URL or a preview panel executes the payload in their browser session.

php

// Composer manifest patch adding SVG sanitizer dependency
         "league/flysystem": "^3.29.1",
         "symfony/http-foundation": "^6.0.3|^7.2|^8.0",
         "symfony/mime": "^6.0|^7.2|^8.0",
-        "spatie/image-optimizer": "^1.8"
+        "spatie/image-optimizer": "^1.8",
+        "enshrined/svg-sanitize": "^0.22.0"
     },

Source: GitHub Commit 65046b2

Detection Methods for CVE-2026-49971

Indicators of Compromise

Uploaded SVG files containing <script> tags, on* event handler attributes, or <foreignObject> elements
Unexpected outbound HTTP requests from user browsers immediately after opening media preview URLs
Session tokens or CSRF values appearing in web server access logs as query parameters
New administrator accounts or privilege changes following media file access events

Detection Strategies

Scan the media storage directory for SVG files and parse them to flag scripting constructs before serving
Inspect HTTP responses that return Content-Type: image/svg+xml and verify sanitization has been applied
Correlate media file access events with subsequent authenticated actions from the same session

Monitoring Recommendations

Log every SVG upload with uploader identity, source IP, and file hash for retrospective review
Alert on browser Content Security Policy (CSP) violation reports referencing media file origins
Monitor for anomalous session activity such as token reuse from multiple IP addresses shortly after media views

How to Mitigate CVE-2026-49971

Immediate Actions Required

Upgrade Laravel-Mediable to version 7.0.0 or later using composer update plank/laravel-mediable
Audit existing SVG uploads for embedded scripts and quarantine suspicious files
Rotate session keys and invalidate active sessions if malicious uploads are found

Patch Information

Version 7.0.0 introduces a file_sanitizers configuration array and ships an SvgSanitizer class backed by the enshrined/svg-sanitize library. The sanitizer strips executable JavaScript from SVG uploads before they are persisted. See the GitHub Release 7.0.0 and the VulnCheck Advisory for details.

Workarounds

Disable SVG uploads entirely by removing image/svg+xml from allowed MIME types
Serve uploaded SVGs with Content-Disposition: attachment to force download instead of inline rendering
Host user-uploaded media on a separate sandbox domain to isolate any XSS from the application origin
Deploy a strict Content Security Policy that blocks inline scripts on pages that render media

bash

# config/mediable.php - register the SVG sanitizer introduced in 7.0.0
'file_sanitizers' => [
    Plank\Mediable\FileSanitizers\SvgSanitizer::class,
],