CVE-2026-86437

Received Received - Intake

Lara Dashboard Core Upgrades Path Traversal

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulnCheck

Description

Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive containing modified application files such as routes/web.php with embedded system commands, which execute as the web server user with access to environment secrets and database credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-07

Last Modified

2026-09-07

Generated

2026-09-08

AI Q&A

2026-09-08

EPSS Evaluated

N/A

NVD

CVE-2026-86437

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Lara Dashboard before version 1.3.2 allows non-Superadmin administrators with settings.edit permission to upload and extract malicious zip archives to the application's source code directory. This is due to improper authorization on the POST /admin/settings/core-upgrades/upload endpoint. Attackers can exploit this to replace critical files like routes/web.php with versions containing system commands, which execute with the web server's privileges.

Detection Guidance

Check for unauthorized POST requests to /admin/settings/core-upgrades/upload with only settings.edit permission. Inspect web server logs for suspicious file uploads or modifications to application files like routes/web.php.

Impact Analysis

This vulnerability allows attackers to gain full control over the affected application by executing arbitrary commands as the web server user. This could lead to unauthorized data access, modification, or deletion, potential data breaches, and complete system compromise. Attackers may steal sensitive data such as environment secrets and database credentials.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized access to sensitive data and potential data breaches. GDPR requires protection of personal data and breach notification, while HIPAA mandates safeguards for protected health information. Exploitation could result in regulatory fines and legal consequences.

Mitigation Strategies

Upgrade Lara Dashboard to version 1.3.2 or later. Remove settings.edit permission for non-Superadmin users. Monitor for unauthorized file uploads and application file changes. Restrict write permissions to application directories.

Hi! I’m here to help you understand CVE-2026-86437. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70