CVE-2026-49971 is a stored cross-site scripting vulnerability in the plank laravel-mediable package prior to version 7.0.0. The vulnerability arises from improper neutralization of input during web page generation, specifically allowing unsanitized SVG files containing embedded scripts in onload event handlers, script tags, or foreignObject elements. When these malicious SVG files are uploaded and later viewed or previewed, the embedded JavaScript executes with full DOM access, enabling persistent XSS attacks.

An attacker can execute arbitrary JavaScript in the victim's browser by uploading crafted SVG files. This can lead to theft of session cookies, capture of CSRF tokens, and potential account takeover. Both authenticated and anonymous users can exploit this vulnerability, increasing the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict or sanitize SVG file uploads to prevent embedded scripts from executing. Consider disabling SVG uploads or implementing server-side validation and sanitization of SVG content to remove script elements and event handlers.