---
id: CVE-2026-90931
title: >-
  LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content
  during media upload, allowing authenticated users with only the media.create
  permission to upload malicious SVG files containing script tags
summary: >-
  LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content
  during media upload, allowing authenticated users with only the media.create
  permission to upload malicious SVG files containing script tags. When any user
  incl…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: laradashboard
product: laradashboard
affected:
  - laradashboard >= 0.9.0 <= 1.4.2
published: '2026-09-14'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:44.497'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90931'
references:
  - url: >-
      https://github.com/laradashboard/laradashboard/security/advisories/GHSA-9gxw-qpx8-x9c7
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/laradashboard-0.9.0-through-1.2.2-stored-xss-via-svg-upload
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/laradashboard/laradashboard/security/advisories/GHSA-9gxw-qpx8-x9c7
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00235
epssPercentile: 0.12869
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-14T20:26:39.704798Z'
ingestedAt: '2026-09-14T15:23:07.430Z'
---

## Overview

LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permission to upload malicious SVG files containing script tags. When any user including administrators opens the stored SVG file served inline from the application origin, the embedded JavaScript executes in the dashboard context, enabling session hijacking and administrative account takeover.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.