CVE-2026-90931: LaraDashboard SVG Upload XSS Vulnerability

CVE-2026-90931 Overview

CVE-2026-90931 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in LaraDashboard versions 0.9.0 through 1.2.2. The application fails to sanitize Scalable Vector Graphics (SVG) file content during media upload. Authenticated users holding only the media.create permission can upload SVG files containing embedded <script> tags. When any user opens the stored SVG served inline from the application origin, the JavaScript executes in the dashboard context. This allows session hijacking and administrative account takeover.

Critical Impact
A low-privileged authenticated user can escalate to administrator by uploading a malicious SVG and waiting for an administrator to view it.

Affected Products

LaraDashboard 0.9.0 through 1.2.2
Deployments allowing media uploads to users with media.create permission
Instances serving uploaded SVG files inline from the application origin

Discovery Timeline

2026-09-14 - CVE-2026-90931 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90931

Vulnerability Analysis

The vulnerability resides in LaraDashboard's media upload handler. The application accepts SVG files without stripping executable content such as <script> blocks, event handlers, or <foreignObject> payloads. SVG is an XML-based format that browsers render with full JavaScript execution when served with a compatible content type.

Because uploaded SVGs are served inline from the same origin as the dashboard, the browser treats embedded scripts as first-party code. Any script executed in this context inherits the session cookies, CSRF tokens, and Document Object Model (DOM) access of the viewing user. An attacker with media.create can therefore weaponize a media library entry to target administrators.

Root Cause

The root cause is missing content sanitization on SVG uploads. LaraDashboard validates file extensions and MIME types but does not parse and strip active XML content. Combined with an inline Content-Disposition response and an origin-hosted delivery path, the SVG becomes an execution vector rather than a static asset.

Attack Vector

An attacker authenticates with a low-privilege account that has the media.create permission. The attacker uploads a crafted SVG file whose XML body contains a <script> element performing session theft or administrative API calls. The attacker then triggers or waits for an administrator to open the media entry. On render, the payload executes with the administrator's session, enabling account takeover or persistence.

No verified public exploit code is available. Refer to the VulnCheck Advisory on Stored XSS and the GitHub Security Advisory GHSA-9gxw-qpx8-x9c7 for technical details.

Detection Methods for CVE-2026-90931

Indicators of Compromise

SVG files in the media library containing <script>, onload, onerror, or <foreignObject> elements
Media upload requests from non-administrative accounts followed by administrator sessions accessing the same asset URL
Outbound requests from administrator browsers to attacker-controlled domains shortly after loading an SVG asset

Detection Strategies

Scan the storage/app/public or configured media directory for SVG files containing script elements or JavaScript URI schemes
Review web server access logs for GET requests to .svg paths with Referer values pointing to administrative dashboard routes
Correlate media.create API events with subsequent privilege changes or new administrator accounts

Monitoring Recommendations

Alert on the creation of new administrator users or role assignments that follow SVG media views
Monitor Content Security Policy (CSP) violation reports for inline script execution on media-serving routes
Track authentication anomalies including session reuse from unexpected IP addresses after SVG interactions

How to Mitigate CVE-2026-90931

Immediate Actions Required

Upgrade LaraDashboard to a version above 1.2.2 that includes the SVG sanitization fix
Audit the media library and remove any SVG files containing script tags or event handler attributes
Revoke media.create from users who do not require upload capability until the patch is applied
Rotate administrator session tokens and review recent privilege changes

Patch Information

A fix is documented in the GitHub Security Advisory GHSA-9gxw-qpx8-x9c7. Apply the vendor-released version that supersedes 1.2.2. Verify the deployed version and clear cached assets after upgrading.

Workarounds

Disable SVG uploads by restricting allowed MIME types and file extensions in the media configuration
Serve uploaded files from a separate sandbox domain to isolate script execution from the dashboard origin
Force SVG downloads by setting Content-Disposition: attachment on media responses to prevent inline rendering
Deploy a strict Content Security Policy that blocks inline scripts on media-serving routes

bash

# Example nginx configuration to force SVG download and restrict inline execution
location ~* \.svg$ {
    add_header Content-Disposition "attachment";
    add_header Content-Security-Policy "default-src 'none'; script-src 'none'";
    add_header X-Content-Type-Options "nosniff";
}