Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

mckenziearts/livewire-markdown-editor

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.1PackagistPublished

    livewire-markdown-editor has arbitrary file upload that allows stored XSS via attachment handler

    GHSA-gxxh-8vcj-w2mh

    Affected
    • Packagist mckenziearts/livewire-markdown-editor < 1.3
    Fixed in
    1.3· Vendor fix available
    Issue
    Impact All versions of mckenziearts/livewire-markdown-editor prior to v1.3 contain a critical arbitrary file upload vulnerability in the MarkdownEditor::updatedAttachments() Livewire handler. The handler calls $file-store() with no server-side validation of MIME type, extension, or file content. Any authenticated user with access to a page embedding <livewire:markdown-editor can upload files of any type (.html, .svg, .js, .php, .exe, etc.) to the disk configured by livewire-markdown-editor.disk. When that disk is a public cloud bucket (S3, DigitalOcean Spaces, Cloudflare R2, Scaleway Object Storage — the common configuration when FILESYSTEMDISK points to such a disk), uploaded files are served publicly with a guessed Content-Type header. The consequences include: - Stored XSS on the storage domain via uploaded .html or .svg files - Phishing page hosting on the application's own storage domain (trust laundering) - Malware distribution from a domain users associate with the application…

    Recommended action: Upgrade to 1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →