CVE-2026-90931

Name of the Vulnerable Software and Affected Versions LaraDashboard versions 0.9.0 through 1.2.2

Description Insufficient sanitization of SVG file content during media upload allows authenticated users with the media.create permission to upload malicious SVG files containing script tags. When a user, including an administrator, opens the stored SVG file served inline from the application origin, the embedded JavaScript executes within the dashboard context. This can lead to session hijacking and administrative account takeover.

Recommendations Update LaraDashboard versions 0.9.0 through 1.2.2 to a newer version that sanitizes SVG uploads. Restrict the use of the media.create permission to trusted users only.