CVE-2026-86437
highLara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin a…
Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive containing modified application files such as routes/web.php with embedded system commands, which execute as the web server user with access to environment secrets and database credentials.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/laradashboard/laradashboard disclosure@vulncheck.com
- https://github.com/laradashboard/laradashboard/blob/v1.3.1/app/Http/Requests/CoreUpgrade/U... disclosure@vulncheck.com
- https://github.com/laradashboard/laradashboard/blob/v1.3.1/app/Policies/SettingPolicy.php#... disclosure@vulncheck.com
- https://github.com/laradashboard/laradashboard/blob/v1.3.1/app/Services/CoreUpgradeService... disclosure@vulncheck.com
- https://github.com/laradashboard/laradashboard/commit/738cc1a219ce459323ef1d09c3789075f1b8... disclosure@vulncheck.com
- https://github.com/laradashboard/laradashboard/releases/tag/v1.3.2 disclosure@vulncheck.com
- https://github.com/laradashboard/laradashboard/security/advisories/GHSA-xv98-x5h7-4g7v disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/lara-dashboard-before-1.3.2-incorrect-authorization-i... disclosure@vulncheck.com
- https://github.com/laradashboard/laradashboard/security/advisories/GHSA-xv98-x5h7-4g7v 134c704f-9b21-4f2e-91b3-4a467353bcc0