Executive brief
Lara Dashboard is a Laravel-based content management system used to manage users, roles, content, and application settings. In versions before 1.3.2, the image and video upload endpoints in the post builder fail to properly check user permissions, allowing authenticated users without content editing rights to upload files to the public web root. If the server is configured to execute the uploaded file types, attackers can achieve remote code execution.
Technical details
The vulnerability is an authorization bypass in the post-builder image and video upload endpoints. The endpoints check that a user is authenticated but fail to validate whether the user has the necessary content creation or editing permissions before accepting the file upload. Attackers can upload polyglot files (files that are valid in multiple formats) with arbitrary extensions to the public web directory. If the web server is configured to execute files of the uploaded type (e.g., .php, .phtml, or other executable extensions), the attacker can achieve remote code execution. The issue requires authentication but no special permissions. Patched in version 1.3.2.
Affected products
- Lara Dashboard Lara Dashboard before 1.3.2
Timeline
- 2026-09-07: disclosed