Vulnerability · Published Sep 14, 2026 · Assigned by VulnCheck

CVE-2026-90931LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Upload

Medium 5.4

In plain English

A medium-severity cross-site scripting in laradashboard from laradashboard. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 85.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permission to upload malicious SVG files containing script tags. When any user including administrators opens the stored SVG file served inline from the application origin, the embedded JavaScript executes in the dashboard context, enabling session hijacking and administrative account takeover.

Affected products (as reported)

Vendor	Product	Versions
laradashboard	laradashboard	0.9.0 – before 1.3.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-9gxw-qpx8-x9c7) vendor-advisory
VulnCheck Advisory: LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Upload third-party-advisory