Description

LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permission to upload malicious SVG files containing script tags. When any user including administrators opens the stored SVG file served inline from the application origin, the embedded JavaScript executes in the dashboard context, enabling session hijacking and administrative account takeover.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-14T13:19:31.350Z",
  "pubdate": "2026-09-14T13:19:31.350Z",
  "executiveSummary": "LaraDashboard versions 0.9.0 through 1.2.2 are susceptible to a Stored Cross-Site Scripting (XSS) vulnerability originating from improper sanitization of user-supplied SVG files during media upload operations.\nThe vulnerability allows authenticated users possessing 'media.create' permissions to inject malicious scripts into SVG files. When these files are accessed by other users, including high-privileged administrators, the payload executes within the application's origin.\nThis vulnerability poses a significant risk to the integrity and confidentiality of the dashboard, as it enables unauthorized session hijacking and potential administrative account takeover.\nThe issue stems from a failure to inspect or sanitize the XML content of uploaded SVG files prior to storage, allowing for the execution of arbitrary JavaScript embedded within SVG elements.\nTo exploit this, an attacker must have sufficient privileges to upload media to the platform. Successful exploitation results in the execution of JavaScript in the context of the victim's session, bypassing security controls that rely on origin-based protections.",
  "technicalDetails": "The root cause of this vulnerability is the absence of server-side sanitization for SVG (Scalable Vector Graphics) files during the media upload process in LaraDashboard versions 0.9.0 through 1.2.2. SVGs are XML-based image formats that support embedded scripts via elements such as <script> or event handler attributes like 'onload'.\nThe vulnerability is located in the media management component, which fails to parse, validate, or sanitize the XML structure of the uploaded file. By failing to strip executable content from the file payload, the application permits the storage of malicious files on the server.\nExploitation follows a specific attack flow: First, the attacker crafts a malicious SVG file containing a JavaScript payload designed to perform actions on behalf of the victim, such as exfiltrating session cookies or performing administrative tasks via background requests. Second, the attacker authenticates as a user with 'media.create' permissions and uploads the malicious SVG through the application's media management interface.\nThird, the application saves the file to the web root or a public storage directory without applying any sanitization or metadata stripping. Fourth, when an unsuspecting user, such as an administrator, views or navigates to the URL where the SVG is hosted, the browser renders the SVG file.\nBecause the SVG is served directly from the application's origin, the browser executes the embedded JavaScript within the dashboard's security context. This effectively bypasses Same-Origin Policy (SOP) restrictions, allowing the payload access to the victim's session tokens, LocalStorage, and SessionStorage.\nThe post-exploitation impact is severe, as the attacker can leverage the victim's administrative privileges to modify system configurations, create new users, or extract sensitive data, ultimately leading to a full system compromise. The vulnerability is highly effective because it relies on the browser's native handling of SVG files as both images and executable documents, making detection difficult if the file appears visually legitimate."
}