# CVE-2026-49971: Plank Laravel-Mediable stored XSS via SVG file upload

Source: https://junglewise.ai/threats/cve-2026-49971-plank-laravel-mediable-stored-xss-via-svg-file-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-49971 · Severity: medium · CVSS 6.1 · Published 2026-07-13

Plank Laravel-Mediable is a library used to manage media files in Laravel web applications. A security flaw allows attackers to upload malicious SVG image files containing hidden scripts. If another user or administrator views these files, the scripts can execute in their browser, potentially leading to the theft of login sessions, sensitive data, or unauthorized actions on their behalf.

Technologies: [Plank Mediable](https://junglewise.ai/threats/technologies/mediable). Vendors: [Plank](https://junglewise.ai/threats/vendors/plank).

## Quick answers

**Is CVE-2026-49971 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49971 being exploited in the wild.

**How severe is CVE-2026-49971?** Medium severity, with a CVSS score of 6.1, published 13 July 2026.

**Which products and versions are affected?** Plank Mediable < 7.0.0.

**Is there a fix for CVE-2026-49971?** A patch was published on 2026-06-13: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49971 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-49971?** Check whether you run Plank Mediable at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in Laravel-Mediable versions prior to 7.0.0 due to insufficient sanitization of uploaded SVG files. Attackers can embed malicious JavaScript within SVG elements such as <script> tags, onload event handlers, or <foreignObject> elements. When a victim previews or opens the uploaded file, the payload executes within the context of the victim's browser session. This can lead to session hijacking, CSRF token theft, and full DOM access. The issue is resolved in version 7.0.0, which introduces a default SvgSanitizer using the enshrined/svg-sanitize package.

## Affected products

- Plank laravel-mediable < 7.0.0

## Timeline

- 2026-06-13: patched: Fix committed to repository
- 2026-07-13: advisory: NVD and VulnCheck advisories published
- 2026-07-13: disclosed: Version 7.0.0 released

## References

- [https://github.com/plank/laravel-mediable/commit/65046b2162fac23ec5d5e8fbdff01a9a0804003e](https://github.com/plank/laravel-mediable/commit/65046b2162fac23ec5d5e8fbdff01a9a0804003e)
- [https://github.com/plank/laravel-mediable/releases/tag/7.0.0](https://github.com/plank/laravel-mediable/releases/tag/7.0.0)
- [https://www.vulncheck.com/advisories/laravel-mediable-stored-xss-via-svg-file-upload](https://www.vulncheck.com/advisories/laravel-mediable-stored-xss-via-svg-file-upload)

## Related threats

- [Plank Laravel-Mediable path traversal in File::sanitizePath](https://junglewise.ai/threats/cve-2026-49970-plank-laravel-mediable-path-traversal-in-file-sanitizepath)
- [Plank laravel-mediable arbitrary file upload in file handling](https://junglewise.ai/threats/cve-2026-4809-plank-laravel-mediable-arbitrary-file-upload-in-file-handling)