Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Laravel-Mediable before 7.0.0 contains a stored cross-site scripting vulnerability that allows authenticated or anonymous users to execute arbitrary JavaScript by uploading unsanitized SVG files containing embedded scripts in onload event handlers, script tags, or foreignObject elements. Attackers can store persistent XSS payloads in uploaded SVG files that execute with full DOM access when victims open or preview the file, enabling session cookie theft, CSRF token capture, and account takeover.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
CVE-2026-49971 Stored Cross-Site Scripting in Laravel-Mediable Before 7.0.0 via SVG Upload https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-49971
Post summary
The text notes a stored XSS vulnerability in Laravel‑Mediable versions before 7.0.0 exploitable via SVG uploads, but provides no details about patches, exploitation tools, or active attacks.
🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-49971](https://github.com/plank/laravel-mediable/commit/65046b2162fac23ec5d5e8fbdff01a9... https://github.com/plank/laravel-mediable/commit/65046b2162fac23ec5d5e8fbdff01a9a0804003e #PatchManagement #Vulnerability #CVE
Post summary
The post references CVE‑2026‑49971 and provides a GitHub commit link that appears to contain a patch, indicating that a fix is available.