{"id":"GHSA-gxxh-8vcj-w2mh","aliases":[],"url":"https://o3.security/vulnerability/GHSA-gxxh-8vcj-w2mh","summary":"livewire-markdown-editor has arbitrary file upload that allows stored XSS via attachment handler","details":"### Impact\nAll versions of `mckenziearts/livewire-markdown-editor` prior to **v1.3** contain a critical arbitrary file upload vulnerability in the `MarkdownEditor::updatedAttachments()` Livewire handler. The handler calls `$file->store()` with no server-side validation of MIME type, extension, or file content.\n\nAny authenticated user with access to a page embedding `<livewire:markdown-editor>` can upload files of any type (`.html`, `.svg`, `.js`, `.php`, `.exe`, etc.) to the disk configured by `livewire-markdown-editor.disk`. When that disk is a public cloud bucket (S3, DigitalOcean Spaces, Cloudflare R2, Scaleway Object Storage — the common configuration when `FILESYSTEM_DISK` points to such a disk), uploaded files are served publicly with a guessed `Content-Type` header.\n\nThe consequences include:\n\n- **Stored XSS** on the storage domain via uploaded `.html` or `.svg` files\n- **Phishing page hosting** on the application's own storage domain (trust laundering)\n- **Malware distribution** from a domain users associate with the application\n- **Markdown injection** in the editor output via crafted filenames (the client-supplied `getClientOriginalName()` value was inserted verbatim into the markdown)\n\nA real-world exploitation of this vulnerability was observed in production on a community platform using this package.\n\n### Patches\n\nUpgrade to **v1.3** or later.\n\n### Workarounds\n\nIf developers cannot upgrade immediately, disable the upload UI on every instance of the editor by passing `:show-upload=\"false\"`:\n\n```blade\n  <livewire:markdown-editor wire:model=\"content\" :show-upload=\"false\" />\n```\n\nThis hides the file input and prevents the vulnerable code path from being reached.\n\n### Resources\n\n- Patch commit: https://github.com/mckenziearts/livewire-markdown-editor/pull/12\n- Release: https://github.com/mckenziearts/livewire-markdown-editor/releases/tag/v1.3\n- CWE-434: https://cwe.mitre.org/data/definitions/434.html\n- CWE-79: https://cwe.mitre.org/data/definitions/79.html","published":"2026-05-04T22:11:05Z","modified":"2026-05-05T16:13:01.980844Z","cvss":{"score":7.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"mckenziearts/livewire-markdown-editor","fixedVersion":"1.3"}],"fix":{"url":"https://github.com/mckenziearts/livewire-markdown-editor/commit/1e60eaa5781e89704e112425f832774be85cd71f","label":"mckenziearts/livewire-markdown-editor@1e60eaa"},"references":[{"type":"WEB","url":"https://github.com/mckenziearts/livewire-markdown-editor/security/advisories/GHSA-gxxh-8vcj-w2mh"},{"type":"WEB","url":"https://github.com/mckenziearts/livewire-markdown-editor/commit/1e60eaa5781e89704e112425f832774be85cd71f"},{"type":"PACKAGE","url":"https://github.com/mckenziearts/livewire-markdown-editor"},{"type":"WEB","url":"https://github.com/mckenziearts/livewire-markdown-editor/releases/tag/v1.3"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-05-05T16:13:01.980844Z"}}