CVE-2026-90932
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in core-upgrade backup handling. CoreUpgradeController and BackupService concatenate the user-supplied backup_file/filename value directly onto the backup directory path without normalization, without basename(), and without verifying the resolved path stays inside storage/app/core-backups. An authenticated user with only settings.edit permission can use ../ sequences to delete arbitrary files or restore a ZIP archive from an arbitrary location, leading to remote code execution.
Risk Assessment
An authenticated non-superadmin user can delete arbitrary files on the host or write malicious files into application directories, potentially leading to full server compromise. The lack of a patched version increases the risk.
Recommendation
Immediately restrict the settings.edit permission to trusted administrators and consider disabling backup functionality until a patch is released. Monitor for unusual file operations.
Other vulnerabilities in LaraDashboard
See all- CVE-2026-90933High
laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET /api/admin/licenses/show, POST /api/admin/licenses/store, and POST /api/admin/licenses/remove endpoints to disclose confidential license keys, inject attacker-controlled values, or delete stored licenses entirely.
- CVE-2026-90931Medium
LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permission to upload malicious SVG files containing script tags. When any user including administrators opens the stored SVG file served inline from the application origin, the embedded JavaScript executes in the dashboard context, enabling session hijacking and administrative account takeover.
Original NVD description (English source)
LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in the core-upgrade backup handling. CoreUpgradeController and BackupService (e.g. BackupService::deleteBackup()) concatenate the user-supplied backup_file/filename value directly onto the backup directory path without normalisation, without applying basename(), and without verifying that the resolved path remains inside storage/app/core-backups; the corresponding form requests only validate the value as a bounded string. An authenticated user holding only the delegated settings.edit permission (not Superadmin) can supply ../ traversal sequences to delete arbitrary files reachable on the host filesystem, including outside the application tree, or to restore a ZIP archive from an arbitrary on-disk location, writing arbitrary files into the application directories and achieving remote code execution. Note: the advisory states the vulnerable concatenation was introduced in the v0.9.7 release line. No patched version was available at the time of publication.