CyberRota Analysis
AI-GeneratedLaraDashboard versions 0.9.2 through 1.2.2 are vulnerable to a path traversal flaw that allows authenticated users with limited permissions to manipulate file paths, potentially leading to the deletion of arbitrary files or remote code execution. This vulnerability arises from improper handling of user-supplied input in the core-upgrade backup functionality, which fails to adequately validate or sanitize file paths. Organizations using affected versions should prioritize remediation to mitigate the risk of unauthorized file access and execution.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in the core-upgrade backup handling. CoreUpgradeController and BackupService (e.g. BackupService::deleteBackup()) concatenate the user-supplied backup_file/filename value directly onto the backup directory path without normalisation, without applying basename(), and without verifying that the resolved path remains inside storage/app/core-backups; the corresponding form requests only validate the value as a bounded string. An authenticated user holding only the delegated settings.edit permission (not Superadmin) can supply ../ traversal sequences to delete arbitrary files reachable on the host filesystem, including outside the application tree, or to restore a ZIP archive from an arbitrary on-disk location, writing arbitrary files into the application directories and achieving remote code execution. Note: the advisory states the vulnerable concatenation was introduced in the v0.9.7 release line. No patched version was available at the time of publication.