CVE-2026-90932: LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE
LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in the core-upgrade backup handling. CoreUpgradeController and BackupService (e.g. BackupService::deleteBackup()) concatenate the user-supplied backupfile/filename value directly onto the backup directory path without normalisation, without applying basename(), and without verifying that the resolved path remains inside storage/app/core-backups; the corresponding form requests only validate the value as a bounded string. An authenticated user holding only the delegated settings.edit permission (not Superadmin) can supply ../ traversal sequences to delete arbitrary files reachable on the host filesystem, including outside the application tree, or to restore a ZIP archive from an arbitrary on-disk location, writing arbitrary files into the application directories and achieving remote code execution. Note: the advisory states the vulnerable concatenation was introduced in the v0.9.7 release line. No patched version was available at the time of publication.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated user with the delegated settings.edit permission can exploit it; Superadmin access is not required. The attack can be performed remotely because the vulnerable functionality is exposed through application requests.
Are all listed versions equally affected?
The advisory lists versions 0.9.2 through 1.2.2 as affected, but also states that the vulnerable concatenation was introduced in the v0.9.7 release line. This creates an inconsistency for versions before 0.9.7 that should be verified against the advisory or source code before prioritizing remediation.
What can an attacker do after reaching the vulnerable backup functions?
Traversal sequences in backup_file or filename can be used to delete files reachable by the host filesystem. An attacker can also restore a ZIP from an arbitrary on-disk location, allowing arbitrary files to be written into application directories and potentially resulting in remote code execution.
What mitigation is available if a patch cannot be applied?
No patched version was available at publication. Restrict or remove settings.edit from untrusted accounts, and prevent those accounts from accessing core-upgrade and backup operations where possible.
How can defenders identify attempted exploitation?
Review core-upgrade and backup-related requests for backup_file or filename values containing ../ traversal sequences. Also investigate unexpected backup restores, unexpected file deletions, and files newly written into application directories.