Quick answers
- Is CVE-2026-86437 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-86437 being exploited in the wild.
- How severe is CVE-2026-86437?
- High severity, with a CVSS score of 7.2, published 7 September 2026.
- Which products and versions are affected?
- Lara Dashboard before 1.3.2.
- Is there a fix for CVE-2026-86437?
- A patch was published on 2026-09-07: Fixed in version 1.3.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-86437 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-86437?
- Check whether you run Lara Dashboard at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The POST /admin/settings/core-upgrades/upload endpoint enforces insufficient authorization checks, validating only the 'manageCoreUpgrades' permission (which is granted to non-superadmin administrators) rather than requiring superadmin-level access. The vulnerable component accepts ZIP file uploads and extracts them over the application source tree without proper sandboxing or integrity verification. An authenticated attacker with settings.edit permissions can craft a malicious ZIP containing modified application files (e.g., routes/web.php with embedded system commands) that execute as the web server user, granting access to environment variables containing database credentials and secrets. This privilege escalation from settings.edit to code execution was patched in version 1.3.2.
Affected products
- Lara Dashboard Lara Dashboard before 1.3.2
Timeline
- 2026-09-07: disclosed
- 2026-09-07: patched: Fixed in version 1.3.2