CVE-2026-86437highCWE-863

CVE-2026-86437: falha de alta gravidade em laradashboard

Lara Dashboard before 1.3.2 Incorrect Authorization in Core-Upgrade Archive Upload

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar laradashboard

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.6epss 0.7%
Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive containing modified application files such as routes/web.php with embedded system commands, which execute as the web server user with access to environment secrets and database credentials.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
laradashboard · laradashboard
CVEs relacionadas — laradashboard

No mesmo produto, das mais perigosas para as menos.

CVE-2026-86438HIGHLara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install ActionEPSS 1.1%CVE-2026-86184CRITICALLara Dashboard before 1.3.0 Missing Authentication in screenshot-login RouteEPSS 1.1%CVE-2026-90932HIGHLaraDashboard 0.9.2 through 1.2.2 Path Traversal RCEEPSS 0.8%CVE-2026-86436MEDIUMLara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload EndpointsEPSS 0.5%CVE-2026-105127MEDIUMLaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery EndpointsEPSS 0.5%CVE-2026-105126HIGHLaraDashboard before 1.4.8 Privilege Escalation via Superadmin Role TamperingEPSS 0.5%