Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-90932— LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE

Quick assessment

Affected
laradashboard laradashboard
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

LaraDashboard 版本 0.9.2 至 1.2.2 在核心升级备份处理中存在路径遍历（Path Traversal）漏洞。具体而言， 和 （例如 ）将用户提供的 / 值直接拼接至备份目录路径，未进行路径规范化，未使用 ，也未校验解析后的路径是否仍位于 目录内；相应的表单请求仅将该值作为有界字符串进行校验。 仅持有 委托权限（而非 Superadmin）的已认证用户，可通过输入包含 的遍历序列，删除主机文件系统中可达的任意文件（包括应用目录树之外的文件），或从磁盘上的任意位置恢复 ZIP 压缩包，从而将任意

CVSS 7.2 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-90932

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE
Source: CVE Program / CVE List V5
Vulnerability Description
LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in the core-upgrade backup handling. CoreUpgradeController and BackupService (e.g. BackupService::deleteBackup()) concatenate the user-supplied backup_file/filename value directly onto the backup directory path without normalisation, without applying basename(), and without verifying that the resolved path remains inside storage/app/core-backups; the corresponding form requests only validate the value as a bounded string. An authenticated user holding only the delegated settings.edit permission (not Superadmin) can supply ../ traversal sequences to delete arbitrary files reachable on the host filesystem, including outside the application tree, or to restore a ZIP archive from an arbitrary on-disk location, writing arbitrary files into the application directories and achieving remote code execution. Note: the advisory states the vulnerable concatenation was introduced in the v0.9.7 release line. No patched version was available at the time of publication.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
文件名或路径的外部可控制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
laradashboard laradashboard 0.9.2 ~ 1.4.2 -

II. Public POCs for CVE-2026-90932

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-90932

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-90932 (2)

Same Patch Batch · laradashboard · 2026-09-14 · 3 CVEs total

CVE-2026-90933 7.1 HIGH laradashboard through 1.2.2 Missing Authorization via License API
CVE-2026-90931 5.4 MEDIUM LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Upload

IV. Related Vulnerabilities

Same product: laradashboard
Same vendor: laradashboard
Same weakness: CWE-73

V. Comments for CVE-2026-90932

No comments yet

Leave a comment