Security: XSS Vulnerability in Media Library Templates

[saeedvir]

🚨 Security: XSS Vulnerability in Media Library Templates

Severity: High

Type: Cross-Site Scripting (XSS)

Description

The media library Blade templates contain XSS vulnerabilities due to unescaped output of the $attributeString variable using {!! !!} syntax.

Affected Files

• resources/views/vendor/media-library/image.blade.php
• resources/views/vendor/media-library/responsiveImage.blade.php
• resources/views/vendor/media-library/responsiveImageWithPlaceholder.blade.php

Vulnerable Code

<img{!! $attributeString !!}[if($loadingAttributeValue)](cci:4://file://if($loadingAttributeValue):0:0-0:0) loading="{{ $loadingAttributeValue }}"[endif](cci:4://file://endif:0:0-0:0) src="{{ $media->getUrl($conversion) }}" alt="{{ $media->name }}">

[imhayatunnabi]

The $attributeString is intentionally unescaped because it contains pre-sanitized HTML attributes. This is not a vulnerability if you're using the package's API correctly.

Safe usage:

{{ $media->img() }} // Attributes are already escaped internally

Only vulnerable if you manually pass unsanitized data:

// DON'T DO THIS
$media->img(['onclick' => $_GET['malicious']]) 

If concerned, sanitize attributes before passing:

$media->img(['alt' => e($userInput)])

The package escapes user-controllable data ($media->name) and expects developers to sanitize custom attributes. This is standard Laravel/Blade behavior, not a security flaw. @saeedvir you can close the issue by simply noticing this.