LaraDashboard discloses SVG sanitization flaw allowing script upload (EUVD-2026-77449)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- LaraDashboard
- Product
- LaraDashboard media upload
- First seen
Summary
The EUVD database, relayed by a Mastodon post, lists a flaw in LaraDashboard versions 0.9.0 through 1.2.2 where SVG content is not sanitized during media upload, with a CVSS v3.1 score of 5.1. The entry says users with only the media.create permission can upload SVG files containing script tags.
If you use LaraDashboard
Upgrade LaraDashboard beyond version 1.2.2 once a fixed release is available.
Restrict the media.create permission to trusted users.
Review uploaded SVG files for embedded script tags.
Restrict access to core-upgrade and backup functions.
Check backup directories for unexpected file deletions or access.
What the sources say 2
· Mastodon: “LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in the core-upgrade backup handling.” Source
· Mastodon: “LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permission to upload malicious SVG files containing script tags.” Source