Executive brief
LaraDashboard is a Laravel-based admin dashboard framework that allows users to upload and manage media files. A vulnerability in versions 0.9.0 through 1.2.2 fails to sanitize SVG files during upload, permitting authenticated users with minimal permissions to upload malicious SVG files containing embedded JavaScript. When administrators or other users view these files through the dashboard, the malicious script executes in the application's context, enabling attackers to steal session tokens and take over administrative accounts.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw caused by two absent security controls: (1) the media upload request handler applies MIME-type validation only in demo mode, leaving production installations with no file-type restrictions, and (2) SVG files are explicitly allowlisted without any content sanitization. An attacker with the low-privilege media.create permission can upload an SVG file containing malicious script tags (e.g., <script> or onload event handlers); the file is stored under the application origin and served inline with Content-Type: image/svg+xml. When any user, including superadministrators, accesses the uploaded SVG through the media library UI or embedded links, the JavaScript executes in the authenticated session context, allowing the attacker to steal CSRF tokens and session cookies to perform administrative actions. No patches are currently available.
Affected products
- LaraDashboard LaraDashboard 0.9.0 through 1.2.2
Timeline
- 2026-08-30: disclosed: GitHub Security Advisory GHSA-9gxw-qpx8-x9c7 published
- 2026-09-14: advisory: CVE-2026-90931 published