CVE-2026-86437

HIGH 7.2

Lara Dashboard before 1.3.2 Incorrect Authorization in Core-Upgrade Archive Upload

CVSS Score

7.2

EPSS Score

0.0%

EPSS Percentile

0th

Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive containing modified application files such as routes/web.php with embedded system commands, which execute as the web server user with access to environment secrets and database credentials.

CWE	CWE-863
Vendor	laradashboard
Product	laradashboard
Published	Sep 7, 2026
Last Updated	Sep 8, 2026

Stay Ahead of the Next One

Get instant alerts for laradashboard laradashboard

Be the first to know when new high vulnerabilities affecting laradashboard laradashboard are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

laradashboard / laradashboard

0 < 1.3.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/laradashboard/laradashboard/security/advisories/GHSA-xv98-x5h7-4g7v github.com: https://github.com/laradashboard/laradashboard/blob/v1.3.1/app/Http/Requests/CoreUpgrade/UploadRequest.php#L15-L18 github.com: https://github.com/laradashboard/laradashboard/blob/v1.3.1/app/Policies/SettingPolicy.php#L47-L50 github.com: https://github.com/laradashboard/laradashboard/blob/v1.3.1/app/Services/CoreUpgradeService.php#L543-L577 github.com: https://github.com/laradashboard/laradashboard/commit/738cc1a219ce459323ef1d09c3789075f1b8d2f2 github.com: https://github.com/laradashboard/laradashboard/releases/tag/v1.3.2 github.com: https://github.com/laradashboard/laradashboard vulncheck.com: https://www.vulncheck.com/advisories/lara-dashboard-before-1.3.2-incorrect-authorization-in-core-upgrade-archive-upload

Credits

EVIL0RD