What is GHSA-j226-63j7-qrqh?

GHSA-j226-63j7-qrqh is a security advisory published by GitHub Security Advisories with Medium severity. Laravel Translation Manager Vulnerable to Stored Cross-site Scripting

Which CVE IDs does GHSA-j226-63j7-qrqh cover?

GHSA-j226-63j7-qrqh covers the following CVE IDs: CVE-2025-49130. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-j226-63j7-qrqh?

GHSA-j226-63j7-qrqh affects 1 product, including: composer/barryvdh/laravel-translation-manager:\u003c 0.6.8.

GHSA-j226-63j7-qrqhMedium

Laravel Translation Manager Vulnerable to Stored Cross-site Scripting

Vendor

GitHub Security Advisories

Published

June 9, 2025

Last Modified

June 9, 2025

🔗 CVE IDs covered (1)

CVE-2025-49130 →

📋 Description

Impact

The application is vulnerable to Cross-Site Scripting (XSS) attacks due to incorrect input validation and sanitization of user-input data. An attacker can inject arbitrary HTML code, including JavaScript scripts, into the page processed by the user's browser, allowing them to steal sensitive data, hijack user sessions, or conduct other malicious activities.

Patches

The issue is fixed in https://github.com/barryvdh/laravel-translation-manager/pull/475 which is released in version 0.6.8

Workarounds

Only authenticated users with access to the translation manager are impacted.

References

[PT-2025-04] laravel translation manager.pdf

Reported by

Positive Technologies (Artem Deikov, Ilya Tsaturov, Daniil Satyaev, Roman Cheremnykh, Artem Danilov, Stanislav Gleym)

🎯 Affected products1

composer/barryvdh/laravel-translation-manager:< 0.6.8