CyberRota Analysis
AI-GeneratedLaravel-Mediable versions prior to 7.0.0 are vulnerable to a stored cross-site scripting (XSS) flaw that allows users to upload unsanitized SVG files containing malicious JavaScript. This vulnerability can lead to the execution of arbitrary scripts with full DOM access, potentially resulting in session cookie theft, CSRF token capture, and account takeover. Organizations using affected versions should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Laravel-Mediable before 7.0.0 contains a stored cross-site scripting vulnerability that allows authenticated or anonymous users to execute arbitrary JavaScript by uploading unsanitized SVG files containing embedded scripts in onload event handlers, script tags, or foreignObject elements. Attackers can store persistent XSS payloads in uploaded SVG files that execute with full DOM access when victims open or preview the file, enabling session cookie theft, CSRF token capture, and account takeover.