CVE-2026-90931— LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Upload
Quick assessment
Affected
laradashboard laradashboard
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
LaraDashboard 从 0.9.0 到 1.2.2 版本在媒体上传过程中未对 SVG 文件内容进行有效净化，使得仅拥有 权限的已认证用户可以上传包含 标签的恶意 SVG 文件。当任何用户（包括管理员）打开由应用源站直接内联返回的已存储 SVG 文件时，其中嵌入的 JavaScript 代码将在仪表盘上下文中执行，从而导致会话劫持和通过接管管理员账号进行权限提升。
Possible ATT&CK Techniques 1 AI
T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-90931
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Upload
Source: CVE Program / CVE List V5
Vulnerability Description
LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permission to upload malicious SVG files containing script tags. When any user including administrators opens the stored SVG file served inline from the application origin, the embedded JavaScript executes in the dashboard context, enabling session hijacking and administrative account takeover.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| laradashboard | laradashboard | 0.9.0 ~ 1.4.2 | - |
|
II. Public POCs for CVE-2026-90931
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-90931
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-90931 (2)
Same Patch Batch · laradashboard · 2026-09-14 · 3 CVEs total
| CVE-2026-90932 | 7.2 HIGH | LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE |
| CVE-2026-90933 | 7.1 HIGH | laradashboard through 1.2.2 Missing Authorization via License API |
IV. Related Vulnerabilities
Same product: laradashboard
-
CVE-2026-90933
laradashboard through 1.2.2 Missing Authorization via Licens -
CVE-2026-90932
LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE -
CVE-2026-87821
Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forge -
CVE-2026-86437
Lara Dashboard before 1.3.2 Incorrect Authorization in Core- -
CVE-2026-86438
Lara Dashboard before 1.3.2 Missing Authorization in Marketp
Same vendor: laradashboard
-
CVE-2026-90933
laradashboard through 1.2.2 Missing Authorization via Licens -
CVE-2026-90932
LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE -
CVE-2026-87821
Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forge -
CVE-2026-86437
Lara Dashboard before 1.3.2 Incorrect Authorization in Core- -
CVE-2026-86438
Lara Dashboard before 1.3.2 Missing Authorization in Marketp
Same weakness: CWE-79
-
CVE-2026-82019
TripleLift video-bundle.js DOM-based XSS via postMessage -
CVE-2026-90957
MISP: Stored XSS via Inline-Served SVG Organisation Logos an -
CVE-2026-78318
Apache Syncope: Unauthenticated reflected XSS in Console and -
CVE-2026-90696
SourceCodester Inventory Management System Product Managemen -
CVE-2026-90695
SourceCodester Inventory Management System Vendor Management
V. Comments for CVE-2026-90931
No comments yet