Read the docs
TI-2025-31210 Aliases CVE-2025-49130GHSA-j226-63j7-qrqh

Laravel Translation Manager Vulnerable to Stored Cross-site Scripting

Priority LOW 27CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Laravel Translation Manager is a package to manage Laravel translation files. Prior to version 0.6.8, the application is vulnerable to Cross-Site Scripting (XSS) attacks due to incorrect input validation and sanitization of user-input data. An attacker can inject arbitrary HTML code, including JavaScript scripts, into the page processed by the user's browser, allowing them to steal sensitive data, hijack user sessions, or conduct other malicious activities. Only authenticated users with access to the translation manager are impacted. The issue is fixed in version 0.6.8.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00435 38th percentileScored 2026-11-07
Fix Fixed laravel-translation-manager (barryvdh): 0.6.8barryvdh/laravel-translation-manager (Packagist): 0.6.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
barryvdhlaravel-translation-managerbefore 0.6.80.6.8Patch availableCNA
—barryvdh/laravel-translation-manager (Packagist)before 0.6.80.6.8Patch availableGHSA-j226-63j7-qrqh
  • laravel-translation-manager Vendorbarryvdh Affected before 0.6.8 Fixed in 0.6.8 Patch available CNA
  • barryvdh/laravel-translation-manager (Packagist) Vendor— Affected before 0.6.8 Fixed in 0.6.8 Patch available GHSA-j226-63j7-qrqh

Remediation

  • Fix · CNA laravel-translation-manager (barryvdh) Fixed in 0.6.8
  • Fix · GHSA-j226-63j7-qrqh barryvdh/laravel-translation-manager (Packagist) Fixed in 0.6.8 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-49130
  2. 2026-10-03 Alias added: GHSA-j226-63j7-qrqh

References

Advisory 1

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences