CVE-2026-90931
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permission to upload malicious SVG files containing script tags. When any user including administrators opens the stored SVG file served inline from the application origin, the embedded JavaScript executes in the dashboard context, enabling session hijacking and administrative account takeover.
Risk Assessment
Risk of administrative account takeover and session hijacking, potentially leading to full system and data compromise.
Recommendation
Upgrade LaraDashboard to a patched version and implement SVG content sanitization before storage.
Other vulnerabilities in LaraDashboard
See all- CVE-2026-90933High
laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET /api/admin/licenses/show, POST /api/admin/licenses/store, and POST /api/admin/licenses/remove endpoints to disclose confidential license keys, inject attacker-controlled values, or delete stored licenses entirely.
- CVE-2026-90932High
LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in core-upgrade backup handling. CoreUpgradeController and BackupService concatenate the user-supplied backup_file/filename value directly onto the backup directory path without normalization, without basename(), and without verifying the resolved path stays inside storage/app/core-backups. An authenticated user with only settings.edit permission can use ../ sequences to delete arbitrary files or restore a ZIP archive from an arbitrary location, leading to remote code execution.
Original NVD description (English source)
LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permission to upload malicious SVG files containing script tags. When any user including administrators opens the stored SVG file served inline from the application origin, the embedded JavaScript executes in the dashboard context, enabling session hijacking and administrative account takeover.