GitHub Advisoryadvisory · Packagist

GHSA-j226-63j7-qrqh Laravel Translation Manager Vulnerable to Stored Cross-site Scripting

MEDIUM Published 2025-06-09 Modified 2025-06-09 Official page ↗
Aliases
CVE-2025-49130
Ecosystem
Packagist
Packages
barryvdh/laravel-translation-manager
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Weaknesses
CWE-79
Reviewed
2025-06-09

Affected packages

• Packagist barryvdh/laravel-translation-manager: < 0.6.8 → fixed in 0.6.8

Description

Impact The application is vulnerable to Cross-Site Scripting (XSS) attacks due to incorrect input validation and sanitization of user-input data. An attacker can inject arbitrary HTML code, including JavaScript scripts, into the page processed by the user's browser, allowing them to steal sensitive data, hijack user sessions, or conduct other malicious activities. Patches The issue is fixed in https://github.com/barryvdh/laravel-translation-manager/pull/475 which is released in version 0.6.8 Workarounds Only authenticated users with access to the translation manager are impacted. References [[PT-2025-04] laravel translation manager.pdf](https://github.com/user-attachments/files/20639250/PT-2025-04.laravel.translation.manager.pdf) Reported by Positive Technologies (Artem Deikov, Ilya Tsaturov, Daniil Satyaev, Roman Cheremnykh, Artem Danilov, Stanislav Gleym)

Related

Alias · CVE (1)

  • CVE-2025-49130 Laravel Translation Manager is a package to manage Laravel translation files. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References