Executive brief
Plank Laravel-Mediable is a library used to manage media files in Laravel web applications. A security flaw allows attackers to upload malicious SVG image files containing hidden scripts. If another user or administrator views these files, the scripts can execute in their browser, potentially leading to the theft of login sessions, sensitive data, or unauthorized actions on their behalf.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Laravel-Mediable versions prior to 7.0.0 due to insufficient sanitization of uploaded SVG files. Attackers can embed malicious JavaScript within SVG elements such as <script> tags, onload event handlers, or <foreignObject> elements. When a victim previews or opens the uploaded file, the payload executes within the context of the victim's browser session. This can lead to session hijacking, CSRF token theft, and full DOM access. The issue is resolved in version 7.0.0, which introduces a default SvgSanitizer using the enshrined/svg-sanitize package.
Affected products
- Plank laravel-mediable < 7.0.0
Timeline
- 2026-06-13: patched: Fix committed to repository
- 2026-07-13: advisory: NVD and VulnCheck advisories published
- 2026-07-13: disclosed: Version 7.0.0 released