CVE-2026-90931: LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Upload
LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permission to upload malicious SVG files containing script tags. When any user including administrators opens the stored SVG file served inline from the application origin, the embedded JavaScript executes in the dashboard context, enabling session hijacking and administrative account takeover.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with the media.create permission can upload a malicious SVG file. Exploitation then requires a user, including an administrator, to open the uploaded SVG.
What is required for the malicious code to run?
The SVG must contain embedded script tags and be served inline from the application origin. JavaScript executes in the dashboard context when the stored file is opened.
What is the likely impact if an administrator opens a malicious upload?
The attacker may hijack the administrator's session and take over the administrative account. The issue can also expose or modify data available through the affected dashboard context.
Which versions are affected?
LaraDashboard versions 0.9.0 through 1.2.2 are affected.