Laravel Translation Manager Vulnerable to Stored Cross-site Scripting
Impact
The application is vulnerable to Cross-Site Scripting (XSS) attacks due to incorrect input validation and sanitization of user-input data. An attacker can inject arbitrary HTML code, including JavaScript scripts, into the page processed by the user's browser, allowing them to steal sensitive data, hijack user sessions, or conduct other malicious activities.
Patches
The issue is fixed in https://github.com/barryvdh/laravel-translation-manager/pull/475 which is released in version 0.6.8
Workarounds
Only authenticated users with access to the translation manager are impacted.
References
[PT-2025-04] laravel translation manager.pdf
Reported by
Positive Technologies (Artem Deikov, Ilya Tsaturov, Daniil Satyaev, Roman Cheremnykh, Artem Danilov, Stanislav Gleym)
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | barryvdh/laravel-translation-manager | < 0.6.8 | 0.6.8 |
References
- https://github.com/barryvdh/laravel-translation-manager/security/advisories/GHSA-j226-63j7-qrqh
- https://nvd.nist.gov/vuln/detail/CVE-2025-49130
- https://github.com/barryvdh/laravel-translation-manager/pull/475
- https://github.com/barryvdh/laravel-translation-manager/commit/527446ed419f90f2319675fc5211cb8f851d7a1f
- https://github.com/barryvdh/laravel-translation-manager
- https://github.com/barryvdh/laravel-translation-manager/releases/tag/v0.6.8
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N- Weakness (CWE)
CWE-79- Platform
- Composer
- Package
barryvdh/laravel-translation-manager- Disclosed
- 09.06.2025
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-j226-63j7-qrqh - CC BY 4.0
Vulnerability history: barryvdh/laravel-translation-manager
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 03.2022 06.2025
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Medium 2
Disclosures per year
- 2022: 1
- 2023: 0
- 2024: 0
- 2025: 1
- 2026: 0
-
Laravel Translation Manager Vulnerable to Stored Cross-site Scripting this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.