CyberRota Analysis
AI-GeneratedLara Dashboard versions prior to 1.3.2 are vulnerable due to inadequate authorization on the post-builder image and video upload endpoints, enabling authenticated users without proper content permissions to upload files. This flaw allows potential attackers to upload malicious polyglot files to the public web root, which could lead to arbitrary code execution if the server configuration allows it. Organizations using affected versions should prioritize this vulnerability to mitigate the risk of unauthorized file uploads and potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chosen extensions to the public web root and execute code if the deployment permits execution of the uploaded file type.