CVE-2026-49971 is a stored cross-site scripting vulnerability in the plank laravel-mediable package before version 7.0.0. The vulnerability occurs because the software does not properly neutralize input during web page generation, specifically failing to sanitize uploaded SVG files. Attackers can embed JavaScript in SVG elements such as onload event handlers, script tags, or foreignObject elements. When these malicious SVG files are opened or previewed by users, the embedded scripts execute with full DOM access, enabling persistent XSS attacks. This can compromise user sessions and security tokens, leading to account compromise.

The vulnerability allows attackers to execute arbitrary JavaScript in the context of the affected application. This can result in theft of session cookies, capture of CSRF tokens, and account takeover. Both authenticated and unauthenticated users can exploit this by uploading crafted SVG files. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, and user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid uploading SVG files or implement strict sanitization of SVG content to remove scripts and event handlers. Monitoring vendor channels for updates is recommended.