Is CVE-2026-90931 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90931 being exploited in the wild.

How severe is CVE-2026-90931?

Medium severity, with a CVSS score of 5.4, published 14 September 2026.

Which products and versions are affected?

LaraDashboard 0.9.0 through 1.2.2.

Is there a fix for CVE-2026-90931?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-90931 attacked?

It is attacked over the network.

Am I affected by CVE-2026-90931?

Check whether you run LaraDashboard at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90931: LaraDashboard stored XSS via unrestricted SVG upload

CVE-2026-90931 · Severity: medium · CVSS 5.4 · Published 2026-09-14

LaraDashboard is a Laravel-based admin dashboard framework that allows users to upload and manage media files. A vulnerability in versions 0.9.0 through 1.2.2 fails to sanitize SVG files during upload, permitting authenticated users with minimal permissions to upload malicious SVG files containing embedded JavaScript. When administrators or other users view these files through the dashboard, the malicious script executes in the application's context, enabling attackers to steal session tokens and take over administrative accounts.

Technologies: LaraDashboard. Vendors: LaraDashboard.

Quick answers

Is CVE-2026-90931 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90931 being exploited in the wild.
How severe is CVE-2026-90931?: Medium severity, with a CVSS score of 5.4, published 14 September 2026.
Which products and versions are affected?: LaraDashboard 0.9.0 through 1.2.2.
Is there a fix for CVE-2026-90931?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90931 attacked?: It is attacked over the network.
Am I affected by CVE-2026-90931?: Check whether you run LaraDashboard at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw caused by two absent security controls: (1) the media upload request handler applies MIME-type validation only in demo mode, leaving production installations with no file-type restrictions, and (2) SVG files are explicitly allowlisted without any content sanitization. An attacker with the low-privilege media.create permission can upload an SVG file containing malicious script tags (e.g., <script> or onload event handlers); the file is stored under the application origin and served inline with Content-Type: image/svg+xml. When any user, including superadministrators, accesses the uploaded SVG through the media library UI or embedded links, the JavaScript executes in the authenticated session context, allowing the attacker to steal CSRF tokens and session cookies to perform administrative actions. No patches are currently available.

Affected products

LaraDashboard LaraDashboard 0.9.0 through 1.2.2

Timeline

2026-08-30: disclosed: GitHub Security Advisory GHSA-9gxw-qpx8-x9c7 published
2026-09-14: advisory: CVE-2026-90931 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.