CVE-2026-49971: fallo de gravedad media en plank laravel-mediable
Laravel-Mediable < 7.0.0 Stored XSS via SVG File Upload
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.4%
Laravel-Mediable before 7.0.0 contains a stored cross-site scripting vulnerability that allows authenticated or anonymous users to execute arbitrary JavaScript by uploading unsanitized SVG files containing embedded scripts in onload event handlers, script tags, or foreignObject elements. Attackers can store persistent XSS payloads in uploaded SVG files that execute with full DOM access when victims open or preview the file, enabling session cookie theft, CSRF token capture, and account takeover.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Productos afectados
plank · laravel-mediableCVEs relacionadas — plank laravel-mediable
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-49972HIGHLaravel-Mediable < 7.0.0 File Upload RCE via Extension BypassEPSS 1.1%CVE-2026-93352CRITICALLaravel-Mediable 7.0.0 < 7.0.2 RCE via .pht File UploadEPSS 1.1%CVE-2026-49970HIGHLaravel-Mediable < 7.0.0 Path Traversal via File::sanitizePath()EPSS 1.0%CVE-2026-4809CRITICALUnsafe Client MIME Type Handling Can Enable Arbitrary File Upload in plank/laravel-mediableEPSS 0.9%CVE-2026-49969MEDIUMLaravel-Mediable < 7.0.0 SSRF via RemoteUrlAdapter URL HandlingEPSS 0.4%