CVE-2026-86437 Details

A vulnerability in Lara Dashboard versions prior to 1.3.2 allows for arbitrary file uploads through the core-upgrades upload endpoint. This issue arises from improper authorization, as the endpoint only requires the settings.edit permission, which is granted to non-superadmin administrators by default. Exploitation of this vulnerability enables the upload and execution of malicious zip archives that can modify application files, such as routes/web.php, to include system commands. These commands are executed as the web server user, potentially exposing sensitive environment secrets and database credentials.

Users are advised to update Lara Dashboard to version 1.4.2 or later, where this vulnerability has been addressed.