PT-2026-57849 · Unknown · Laravel-Mediable

Vulncheck + 1 · Published 2026-07-13 · Updated 2026-07-13 · CVE-2026-49971

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Laravel-Mediable versions prior to 7.0.0

Description Stored cross-site scripting occurs when authenticated or anonymous users upload unsanitized SVG files containing embedded scripts in onload event handlers, script tags, or foreignObject elements. These persistent payloads execute with full DOM access when a victim opens or previews the file, which can lead to session cookie theft, CSRF token capture, and account takeover.

Recommendations Update Laravel-Mediable to version 7.0.0 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-49971

Affected Products

Laravel-Mediable

References · 5

• https://github.com/plank/laravel-mediable/commit/65046b2162fac23ec5d5e8fbdff01a9a0804003e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-49971 · Security Note
• https://github.com/plank/laravel-mediable/releases/tag/7.0.0 · Note
• https://vulncheck.com/advisories/laravel-mediable-stored-xss-via-svg-file-upload · Note
• https://twitter.com/VulmonFeeds/status/2076765321902334399 · Twitter Post