CVE-2026-90932
Received Received - Intake

Path Traversal in LaraDashboard via Backup Handling

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulnCheck

Description
LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in the core-upgrade backup handling. CoreUpgradeController and BackupService (e.g. BackupService::deleteBackup()) concatenate the user-supplied backup_file/filename value directly onto the backup directory path without normalisation, without applying basename(), and without verifying that the resolved path remains inside storage/app/core-backups; the corresponding form requests only validate the value as a bounded string. An authenticated user holding only the delegated settings.edit permission (not Superadmin) can supply ../ traversal sequences to delete arbitrary files reachable on the host filesystem, including outside the application tree, or to restore a ZIP archive from an arbitrary on-disk location, writing arbitrary files into the application directories and achieving remote code execution. Note: the advisory states the vulnerable concatenation was introduced in the v0.9.7 release line. No patched version was available at the time of publication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90932
EUVD
EUVD-2026-77450

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
laradashboard laradashboard From 0.9.2 (inc) to 1.2.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a path traversal vulnerability in LaraDashboard versions 0.9.2 through 1.2.2. It exists in the CoreUpgradeController and BackupService components where user-supplied input in backup file handling is directly concatenated to directory paths without proper validation or normalization. An authenticated user with only the delegated settings.edit permission can exploit this by using ../ sequences to delete arbitrary files outside the application directory or restore ZIP archives from arbitrary locations, enabling file writes and potential code execution.

Detection Guidance

Check LaraDashboard versions between 0.9.2 and 1.2.2. Look for suspicious file operations in backup handling. Review logs for path traversal attempts like ../ sequences in backup_file parameters. Inspect CoreUpgradeController and BackupService for direct path concatenation without basename() or containment checks.

Impact Analysis

An attacker can delete critical files like .env, storage/, or the database causing denial of service. They can also write malicious files into the application directories by restoring a ZIP archive from an arbitrary location, leading to remote code execution. This can result in full system compromise, data theft, or further network infiltration.

Compliance Impact

This vulnerability could lead to unauthorized data access, modification, or deletion, violating GDPR's integrity and confidentiality principles and HIPAA's security rule requirements for protecting patient data. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade to a patched version if available. Implement strict input validation for backup_file parameters. Apply basename() and realpath containment checks. Restrict settings.edit permission to trusted users. Monitor for unauthorized file deletions or writes in application directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90932. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart