Laravel Mail Builder Laravel Package

Product Decisions This Supports

• Security-risk prioritization: v2.5.3 closes a local-file disclosure hole in CID image embedding. When MailBuilder::embedCidImages() or CidImageEmbedder::embed() is given a base path, a relative src such as ../secret could previously attach a file from outside that directory. This is a direct input for sequencing: if you pass a base path while embedding HTML you do not fully control (customer-supplied templates, imported HTML, multi-tenant content), treat this as a must-ship patch rather than a routine bump.
• Trust-boundary decisions for multi-tenant and agency products: The fix only affects calls that pass a base path; data-URI-only usage is unchanged. That gives a clean decision rule: products where end users or tenants author HTML that reaches CID embedding should upgrade immediately, and should also treat the base path as a security boundary in their own design reviews.
• Behavior-change review, not just a version bump: Legitimate setups that relied on reaching a parent directory (for example pointing the base path at a subfolder while referencing images one level up) will silently stop embedding those images — the new rules require the resolved path to stay inside the base path, be a regular readable file of at most 5 MB, and have an image MIME type. Budget a quick audit of existing templates and base-path configuration before rollout, and check whether any images are now skipped.
• Authoring UX investment (carried from v2.4.0): The grouped, searchable tile palette with separate Blocks/Structure tabs still supports roadmap decisions to improve time-to-first-email, reduce editor training, and make advanced block types discoverable to non-technical marketers.
• Build vs. buy for email composition: The package still provides a schema-driven editor, block library, Filament integration, and compiled-email output. A security fix shipped promptly in a patch release strengthens the "buy/integrate" case — you are buying maintained hardening, not just features.
• Custom editor and integration decisions: Schema export v3 adds groups, short_label, group, and description while keeping existing keys unchanged, so building custom palettes, admin surfaces, or downstream tooling on top of the schema does not require forking the editor.
• Upgrade and platform-risk decisions: Stored documents and compiled email remain unchanged, so this stays a low-data-risk upgrade. Two operational tasks: republish editor assets (include the new icons.js, which odden-mail-editor.js imports), and verify CID embedding behavior if you pass a base path. Note that v2.5.3 is a multi-minor jump from v2.4.0 — review the intermediate changelogs alongside this advisory so nothing else is missed.
• Use cases: Marketing campaign builders, transactional email template authoring, agency/admin tools, Filament-based content operations, and products where business users assemble emails from approved blocks rather than write HTML.

When to Consider This Package

• Consider it when you need a Laravel-native, schema-driven email builder with a broad block library, Filament admin support, and an editor that can be embedded or customized without building block selection, grouping, search, and accessibility patterns from scratch.
• Prioritize upgrading to v2.5.3 immediately if you call embedCidImages() or CidImageEmbedder::embed() with a base path and the HTML can come from users, tenants, imports, or any source you do not fully control. This is a file-disclosure fix, and the exposure predates this release.
• Deprioritize (but still schedule) the patch if you only embed data URIs without a base path, or only use the editor UI and Filament surface — those paths behave exactly as before.
• It is a good fit if your team values backward compatibility: no changes to stored documents or compiled email, the editor still tolerates schemas without the new v3 keys, and the security fix is constrained to base-path callers.
• Adopt with more caution if you self-host editor assets and cannot easily update published JS, since the editor requires icons.js alongside the existing files.
• Watch for regressions if your base-path layout deliberately referenced files outside the base directory, or if you embed images near or above 5 MB — those will now be skipped. Confirm your MIME detection (fileinfo) is reliable in your runtime, since embedding now depends on it.
• Look elsewhere if you need a general page builder rather than an email builder, require a fully bespoke design system that cannot be expressed through the provided schema and blocks, or cannot manage Laravel asset publishing and frontend asset updates as part of your release process.

How to Pitch It (Stakeholders)

For executives: v2.5.3 is a security hardening patch for the email builder. It closes a case where a crafted relative image path could attach a file from outside the intended image directory when embedding images into emails. Only setups that supply a base path while embedding HTML they do not fully control are affected; everything else behaves as before. There are no changes to stored documents or compiled emails, so the data risk is low. Recommend shipping this promptly if any customer or tenant content flows through image embedding, and treating the small template audit as part of the release.

For engineering: Treat this as a required patch with one behavior change. Run composer update getodden/mail, republish assets with php artisan vendor:publish --tag=mail-builder-assets --force or php artisan filament:assets, and confirm self-hosted bundles include icons.js. Then audit every caller that passes a base path: embedding now requires the resolved path to stay inside the base path, be a regular readable file of at most 5 MB, and carry an image MIME type; URLs, stream wrappers (php://, file://) and protocol-relative addresses are never treated as local paths. Calls without a base path (data URIs only) are untouched. Expect previously working parent-directory references to stop embedding, verify fileinfo/MIME detection in your runtime, and check for images that silently drop out. Since this jumps from v2.4.0 to v2.5.3, review the intermediate changelogs for anything else landing in the same upgrade.