CVE-2026-90931CWE-79cross-site-scripting

CVE-2026-90931

Medium · published September 14, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
13.6
In the wild
Unconfirmed
What it is

LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permission to upload malicious SVG files containing script tags. When any user including administrators opens the stored SVG file served inline from the application origin, the embedded JavaScript executes in the dashboard context, enabling session hijacking and administrative account takeover.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00235 · 13.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-14T17:19Z
References (3)
https://github.com/laradashboard/laradashboard/security/advisories/GHSA-9gxw-qpx8-x9c7 · [email protected]https://www.vulncheck.com/advisories/laradashboard-0.9.0-through-1.2.2-stored-xss-via-svg-upload · [email protected]https://github.com/laradashboard/laradashboard/security/advisories/GHSA-9gxw-qpx8-x9c7 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 14 SEP 12:48Z
    LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Upload
    cvelistv5