{"id":"GHSA-gxxh-8vcj-w2mh","aliases":[],"status":"published","title":"livewire-markdown-editor has arbitrary file upload that allows stored XSS via attachment handler","description":"### Impact\nAll versions of `mckenziearts/livewire-markdown-editor` prior to **v1.3** contain a critical arbitrary file upload vulnerability in the `MarkdownEditor::updatedAttachments()` Livewire handler. The handler calls `$file-\u003estore()` with no server-side validation of MIME type, extension, or file content.\n\nAny authenticated user with access to a page embedding `\u003clivewire:markdown-editor\u003e` can upload files of any type (`.html`, `.svg`, `.js`, `.php`, `.exe`, etc.) to the disk configured by `livewire-markdown-editor.disk`. When that disk is a public cloud bucket (S3, DigitalOcean Spaces, Cloudflare R2, Scaleway Object Storage — the common configuration when `FILESYSTEM_DISK` points to such a disk), uploaded files are served publicly with a guessed `Content-Type` header.\n\nThe consequences include:\n\n- **Stored XSS** on the storage domain via uploaded `.html` or `.svg` files\n- **Phishing page hosting** on the application's own storage domain (trust laundering)\n- **Malware distribution** from a domain users associate with the application\n- **Markdown injection** in the editor output via crafted filenames (the client-supplied `getClientOriginalName()` value was inserted verbatim into the markdown)\n\nA real-world exploitation of this vulnerability was observed in production on a community platform using this package.\n\n### Patches\n\nUpgrade to **v1.3** or later.\n\n### Workarounds\n\nIf developers cannot upgrade immediately, disable the upload UI on every instance of the editor by passing `:show-upload=\"false\"`:\n\n```blade\n  \u003clivewire:markdown-editor wire:model=\"content\" :show-upload=\"false\" /\u003e\n```\n\nThis hides the file input and prevents the vulnerable code path from being reached.\n\n### Resources\n\n- Patch commit: https://github.com/mckenziearts/livewire-markdown-editor/pull/12\n- Release: https://github.com/mckenziearts/livewire-markdown-editor/releases/tag/v1.3\n- CWE-434: https://cwe.mitre.org/data/definitions/434.html\n- CWE-79: https://cwe.mitre.org/data/definitions/79.html","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-434","CWE-79"],"published":"2026-05-04T22:11:05Z","modified":"2026-05-05T16:13:01Z","fixes":[{"ecosystem":"Packagist","package":"mckenziearts/livewire-markdown-editor","fixed_in":["1.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"mckenziearts/livewire-markdown-editor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3"}]}]},{"source":"osv","ecosystem":"Packagist","package":"mckenziearts/livewire-markdown-editor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3"}]}],"versions":["v1.0","v1.0.1","v1.1","v1.2"]}],"references":[{"url":"https://github.com/mckenziearts/livewire-markdown-editor/security/advisories/GHSA-gxxh-8vcj-w2mh","tags":["web"]},{"url":"https://github.com/mckenziearts/livewire-markdown-editor/commit/1e60eaa5781e89704e112425f832774be85cd71f","tags":["web"]},{"url":"https://github.com/mckenziearts/livewire-markdown-editor/releases/tag/v1.3","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gxxh-8vcj-w2mh"},{"url":"https://github.com/mckenziearts/livewire-markdown-editor","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-gxxh-8vcj-w2mh","title":"livewire-markdown-editor has arbitrary file upload that allows stored XSS via attachment handler","description":"### Impact\nAll versions of `mckenziearts/livewire-markdown-editor` prior to **v1.3** contain a critical arbitrary file upload vulnerability in the `MarkdownEditor::updatedAttachments()` Livewire handler. The handler calls `$file-\u003estore()` with no server-side validation of MIME type, extension, or file content.\n\nAny authenticated user with access to a page embedding `\u003clivewire:markdown-editor\u003e` can upload files of any type (`.html`, `.svg`, `.js`, `.php`, `.exe`, etc.) to the disk configured by `livewire-markdown-editor.disk`. When that disk is a public cloud bucket (S3, DigitalOcean Spaces, Cloudflare R2, Scaleway Object Storage — the common configuration when `FILESYSTEM_DISK` points to such a disk), uploaded files are served publicly with a guessed `Content-Type` header.\n\nThe consequences include:\n\n- **Stored XSS** on the storage domain via uploaded `.html` or `.svg` files\n- **Phishing page hosting** on the application's own storage domain (trust laundering)\n- **Malware distribution** from a domain users associate with the application\n- **Markdown injection** in the editor output via crafted filenames (the client-supplied `getClientOriginalName()` value was inserted verbatim into the markdown)\n\nA real-world exploitation of this vulnerability was observed in production on a community platform using this package.\n\n### Patches\n\nUpgrade to **v1.3** or later.\n\n### Workarounds\n\nIf developers cannot upgrade immediately, disable the upload UI on every instance of the editor by passing `:show-upload=\"false\"`:\n\n```blade\n  \u003clivewire:markdown-editor wire:model=\"content\" :show-upload=\"false\" /\u003e\n```\n\nThis hides the file input and prevents the vulnerable code path from being reached.\n\n### Resources\n\n- Patch commit: https://github.com/mckenziearts/livewire-markdown-editor/pull/12\n- Release: https://github.com/mckenziearts/livewire-markdown-editor/releases/tag/v1.3\n- CWE-434: https://cwe.mitre.org/data/definitions/434.html\n- CWE-79: https://cwe.mitre.org/data/definitions/79.html","status":"published","published":"2026-05-04T22:11:05Z","modified":"2026-05-04T22:11:07Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"high"}],"cwes":["CWE-79","CWE-434"],"updated_at":"2026-11-02T14:40:00.970271Z"}],"osv":[{"id":"GHSA-gxxh-8vcj-w2mh","title":"livewire-markdown-editor has arbitrary file upload that allows stored XSS via attachment handler","description":"### Impact\nAll versions of `mckenziearts/livewire-markdown-editor` prior to **v1.3** contain a critical arbitrary file upload vulnerability in the `MarkdownEditor::updatedAttachments()` Livewire handler. The handler calls `$file-\u003estore()` with no server-side validation of MIME type, extension, or file content.\n\nAny authenticated user with access to a page embedding `\u003clivewire:markdown-editor\u003e` can upload files of any type (`.html`, `.svg`, `.js`, `.php`, `.exe`, etc.) to the disk configured by `livewire-markdown-editor.disk`. When that disk is a public cloud bucket (S3, DigitalOcean Spaces, Cloudflare R2, Scaleway Object Storage — the common configuration when `FILESYSTEM_DISK` points to such a disk), uploaded files are served publicly with a guessed `Content-Type` header.\n\nThe consequences include:\n\n- **Stored XSS** on the storage domain via uploaded `.html` or `.svg` files\n- **Phishing page hosting** on the application's own storage domain (trust laundering)\n- **Malware distribution** from a domain users associate with the application\n- **Markdown injection** in the editor output via crafted filenames (the client-supplied `getClientOriginalName()` value was inserted verbatim into the markdown)\n\nA real-world exploitation of this vulnerability was observed in production on a community platform using this package.\n\n### Patches\n\nUpgrade to **v1.3** or later.\n\n### Workarounds\n\nIf developers cannot upgrade immediately, disable the upload UI on every instance of the editor by passing `:show-upload=\"false\"`:\n\n```blade\n  \u003clivewire:markdown-editor wire:model=\"content\" :show-upload=\"false\" /\u003e\n```\n\nThis hides the file input and prevents the vulnerable code path from being reached.\n\n### Resources\n\n- Patch commit: https://github.com/mckenziearts/livewire-markdown-editor/pull/12\n- Release: https://github.com/mckenziearts/livewire-markdown-editor/releases/tag/v1.3\n- CWE-434: https://cwe.mitre.org/data/definitions/434.html\n- CWE-79: https://cwe.mitre.org/data/definitions/79.html","status":"published","published":"2026-05-04T22:11:05Z","modified":"2026-05-05T16:13:01.980844Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","level":"high"}],"cwes":["CWE-434","CWE-79"],"updated_at":"2026-11-02T15:46:48.546324Z"}]}}