CVE-2026-90931 in LaraDashboard
Summary
by MITRE • 09/14/2026
LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permission to upload malicious SVG files containing script tags. When any user including administrators opens the stored SVG file served inline from the application origin, the embedded JavaScript executes in the dashboard context, enabling session hijacking and administrative account takeover.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified in LaraDashboard versions 0.9.0 through 1.2.2 represents a critical server-side input validation failure that leads to Stored Cross-Site Scripting within the application's media management subsystem. The core technical flaw resides in the file upload handler, which accepts SVG files without performing adequate sanitization of their internal content structure. Specifically, the system fails to strip or neutralize executable JavaScript code embedded within the Scalable Vector Graphics markup before storing it on the server filesystem and subsequently serving it back to clients. This lack of rigorous validation allows an attacker with authenticated access and the media.create permission to inject malicious payloads directly into the application's storage infrastructure. The vulnerability is not limited to a specific user role, as any account possessing the ability to upload media can exploit this flaw, lowering the barrier for initial compromise significantly compared to vulnerabilities requiring administrative privileges.
The operational impact of this vulnerability is severe due to the manner in which SVG files are rendered by modern web browsers and served by the application. When an uploaded SVG file containing script tags is accessed, it is often displayed inline within the browser window rather than as a separate resource with its own origin context. Because the SVG content originates from the same domain as the LaraDashboard interface, the embedded JavaScript executes with full privileges of that origin. This environment allows the malicious scripts to access cookies, local storage, and session tokens associated with the dashboard. Consequently, an attacker can craft payloads designed to exfiltrate authentication sessions or perform actions on behalf of other users without their knowledge. The most critical consequence is the potential for complete administrative account takeover, as attackers can hijack high-privilege sessions by stealing credentials stored in browser memory or manipulating session identifiers through DOM-based attacks facilitated by the injected scripts.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. More specifically, it falls under Stored XSS where the malicious payload is permanently stored on the target server, such as in a database or file system, and later served to victims. The attack vector leverages CWE-20 for improper input validation during media upload processes. In terms of offensive security frameworks like MITRE ATT&CK, this vulnerability facilitates techniques related to Collection via Browser Harvesting and Account Manipulation through Session Hijacking. The ability to execute arbitrary code in the context of a trusted application origin effectively bypasses many standard browser security policies such as Same-Origin Policy protections that would otherwise restrict cross-domain script execution.
Mitigation strategies must focus on implementing robust input validation and output encoding mechanisms within the media upload pipeline. Developers should enforce strict allow-listing for SVG content, ensuring that only safe vector graphics elements are permitted while stripping all executable code including JavaScript event handlers, foreign objects, and embedded scripts. Utilizing established libraries designed specifically for sanitizing SVG markup can help neutralize potential attack vectors before storage. Additionally, implementing Content Security Policy headers with a nonce or hash-based approach can mitigate the impact of any successfully injected scripts by restricting where they are allowed to execute. For users currently running affected versions, immediate upgrading to a patched version is recommended alongside auditing uploaded media files for suspicious content and rotating all session tokens to invalidate potentially compromised sessions.