CVE-2026-49971: medium-severity vulnerability in plank laravel-mediable
Laravel-Mediable < 7.0.0 Stored XSS via SVG File Upload
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.4%
Laravel-Mediable before 7.0.0 contains a stored cross-site scripting vulnerability that allows authenticated or anonymous users to execute arbitrary JavaScript by uploading unsanitized SVG files containing embedded scripts in onload event handlers, script tags, or foreignObject elements. Attackers can store persistent XSS payloads in uploaded SVG files that execute with full DOM access when victims open or preview the file, enabling session cookie theft, CSRF token capture, and account takeover.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Affected products
plank · laravel-mediableRelated CVEs — plank laravel-mediable
In the same product, most dangerous first.
CVE-2026-49972HIGHLaravel-Mediable < 7.0.0 File Upload RCE via Extension BypassEPSS 1.1%CVE-2026-93352CRITICALLaravel-Mediable 7.0.0 < 7.0.2 RCE via .pht File UploadEPSS 1.1%CVE-2026-49970HIGHLaravel-Mediable < 7.0.0 Path Traversal via File::sanitizePath()EPSS 1.0%CVE-2026-4809CRITICALUnsafe Client MIME Type Handling Can Enable Arbitrary File Upload in plank/laravel-mediableEPSS 0.9%CVE-2026-49969MEDIUMLaravel-Mediable < 7.0.0 SSRF via RemoteUrlAdapter URL HandlingEPSS 0.4%