Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a stored Cross-Site Scripting (XSS) issue within the Laravel Translation Manager. It stems from two main areas: insufficient input sanitization when adding new translation groups or locales, and lack of output escaping when displaying these and other translation-related data in the manager's interface.
postAddGroup and postAddLocale methods in src/Controller.php did not adequately sanitize user-provided names for new groups and locales. Attackers could submit names containing malicious scripts.resources/views/index.php template, rendered by the getIndex method in src/Controller.php, displayed various pieces of data (group names, locale names, translation keys, and translation values) without proper HTML escaping.When an attacker injects a malicious script via postAddGroup or postAddLocale (or by directly manipulating translation strings if allowed), this script is stored in the database. Later, when any authenticated user with access to the translation manager views the page rendered by getIndex (which uses index.php), the stored malicious script is outputted directly into the HTML, causing it to execute in the user's browser. This could lead to session hijacking, data theft, or other malicious actions.
The patch addresses these issues by:
sanitizeFilename method in Controller.php and using it to clean the new-group and new-locale inputs in postAddGroup and postAddLocale respectively.resources/views/index.php to use Laravel's e() helper function for escaping all dynamic data being outputted, thus preventing injected scripts from executing.| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| barryvdh/laravel-translation-manager | composer | < 0.6.8 | 0.6.8 |