CVE-2026-86437 in Lara Dashboard
Summary
by MITRE • 09/08/2026
Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive containing modified application files such as routes/web.php with embedded system commands, which execute as the web server user with access to environment secrets and database credentials.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability in Lara Dashboard versions prior to 1.3.2 represents a critical authorization flaw within the administrative interface that facilitates remote code execution through improper permission validation on file upload endpoints. Specifically, the POST /admin/settings/core-upgrades/upload endpoint is designed to handle system updates by accepting zip archives for extraction into the application directory. However, the access control mechanism governing this endpoint relies solely on the settings.edit permission rather than requiring a higher-level privilege such as Superadmin status. This misconfiguration allows any user account possessing the settings.edit role to interact with the upload functionality, bypassing the intended restriction that limits system modification capabilities to trusted administrators only.
The technical exploitation of this flaw involves crafting a malicious zip archive containing modified application files, most notably critical routing or configuration scripts such as routes/web.php. By uploading and extracting this archive over the live application source code, an attacker can effectively overwrite existing logic with their own payload. The extraction process places these files directly into the web server's document root or core directories, where they are immediately processed by the PHP runtime environment. Because the upload mechanism does not validate file contents or restrict executable types beyond standard extension checks, attackers can embed arbitrary system commands within legitimate-looking code structures to achieve persistent access and control over the underlying infrastructure.
The operational impact of this vulnerability is severe, as it leads directly to remote code execution with the privileges of the web server process. In typical deployment scenarios, such as those using Apache or Nginx combined with PHP-FPM, the web server user often possesses elevated permissions necessary for reading configuration files and accessing database credentials stored in environment variables. Consequently, an attacker who exploits this flaw can not only execute arbitrary commands on the host system but also exfiltrate sensitive data including database passwords, API keys, and other secrets configured within the application's runtime environment. This level of compromise effectively grants full control over the web server and potentially allows for lateral movement into internal networks if the compromised instance has access to additional services or databases.
To mitigate this risk, organizations running Lara Dashboard versions before 1.3.2 should immediately upgrade to the patched version where proper authorization checks have been implemented. Until an upgrade is feasible, administrators can apply a temporary workaround by restricting web server configuration to deny direct POST requests to the /admin/settings/core-upgrades/upload endpoint for all users except those with Superadmin privileges at the reverse proxy or firewall level. Additionally, implementing strict file integrity monitoring and ensuring that the web server user operates under least-privilege principles can help limit the blast radius of such an exploitation attempt. This vulnerability is categorized under CWE-269 Improper Privilege Management within common weakness enumerations and aligns with ATT&CK techniques related to Initial Access via Valid Accounts and Execution through Command and Script Interpretation, highlighting the importance of rigorous access control policies in administrative interfaces handling sensitive system operations.