LaraDashboard up to 1.4.7 composer.json lang path traversal

Summaryinfo

A vulnerability, which was classified as problematic, was found in LaraDashboard up to 1.4.7. Affected by this vulnerability is an unknown functionality of the file composer.json. Executing a manipulation of the argument lang can lead to path traversal. This vulnerability is registered as CVE-2026-105125. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in LaraDashboard up to 1.4.7. This vulnerability affects some unknown functionality of the file composer.json. The manipulation of the argument lang with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality. CVE summarizes:

LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the {lang} route segment. On Windows hosts, attackers can send URL-encoded backslash sequences like ..%5C to escape resources/lang and read composer.json or other application JSON files.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-105125 since 10/03/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

By approaching the search of inurl:composer.json it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.4.8 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-92047). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Forum Software

Name

• LaraDashboard

Version

• 1.4.0
• 1.4.1
• 1.4.2
• 1.4.3
• 1.4.4
• 1.4.5
• 1.4.6
• 1.4.7

Website

• Product: https://github.com/laradashboard/laradashboard/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion