Executive brief
Lara Dashboard is a Laravel-based CMS used to manage users, roles, permissions, and application settings. The vulnerability allows non-superadmin administrators with basic settings-edit permissions to upload and extract malicious ZIP archives directly over the live application source code, enabling them to modify application files and inject commands that execute with web server privileges and access to database credentials.
Technical details
The POST /admin/settings/core-upgrades/upload endpoint enforces insufficient authorization checks, validating only the 'manageCoreUpgrades' permission (which is granted to non-superadmin administrators) rather than requiring superadmin-level access. The vulnerable component accepts ZIP file uploads and extracts them over the application source tree without proper sandboxing or integrity verification. An authenticated attacker with settings.edit permissions can craft a malicious ZIP containing modified application files (e.g., routes/web.php with embedded system commands) that execute as the web server user, granting access to environment variables containing database credentials and secrets. This privilege escalation from settings.edit to code execution was patched in version 1.3.2.
Affected products
- Lara Dashboard Lara Dashboard before 1.3.2
Timeline
- 2026-09-07: disclosed
- 2026-09-07: patched: Fixed in version 1.3.2