CVE-2026-105125: LaraDashboard Path Traversal Vulnerability

CVE-2026-105125 Overview

CVE-2026-105125 is a path traversal vulnerability [CWE-22] in LaraDashboard versions prior to 1.4.8. The flaw resides in the API translations endpoint, which exposes the {lang} route segment to unauthenticated callers without validation. Attackers can submit URL-encoded traversal sequences such as ..%5C to escape the resources/lang directory on Windows hosts. Successful exploitation reads arbitrary JSON files on disk, including composer.json and other application metadata.

Critical Impact
Unauthenticated remote attackers can read arbitrary JSON files from the application filesystem by manipulating the {lang} route parameter on Windows deployments.

Affected Products

LaraDashboard versions prior to 1.4.8
Windows-hosted LaraDashboard deployments exposing the /api/translations/{lang} endpoint
Laravel applications built on vulnerable LaraDashboard releases (confirmed in v1.4.2 route definitions)

Discovery Timeline

2026-10-04 - CVE-2026-105125 published to NVD
2026-10-05 - Last updated in NVD database

Technical Details for CVE-2026-105125

Vulnerability Analysis

The vulnerability exists in the translations API route handler, which accepts a {lang} segment and uses it to construct a filesystem path under resources/lang. The handler fails to validate the parameter against an allow-list or canonicalize the resolved path. An unauthenticated attacker can submit traversal sequences in the URL to request files outside the intended directory.

On Windows, the directory separator \ can be URL-encoded as %5C to bypass naive filters that only check for forward slashes. The server decodes the sequence, appends .json, and returns the contents of any JSON file the web process can read. Disclosed data includes composer.json, which reveals installed packages and dependency versions useful for follow-on attacks.

Root Cause

The root cause is missing input validation and path canonicalization in the translations controller. The route parameter flows directly into a File::get() call without pattern matching, realpath resolution, or containment checks against the intended resources/lang base directory.

Attack Vector

An unauthenticated attacker sends an HTTP GET request to the translations endpoint with a crafted {lang} value. On Windows hosts, a payload such as /api/translations/..%5C..%5Ccomposer instructs the handler to resolve a path outside resources/lang. The handler reads the file and returns its JSON contents in the HTTP response.

php

+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Support\Facades\File;
+
+class TranslationController extends Controller
+{
+    public function __invoke(string $lang): JsonResponse
+    {
+        if (preg_match('/^[A-Za-z0-9_-]+$/', $lang) !== 1) {
+            return response()->json(['error' => 'Language not found'], 404);
+        }
+
+        $directory = realpath(resource_path('lang'));
+        $path = realpath(resource_path('lang'.DIRECTORY_SEPARATOR.$lang.'.json'));
+
+        if (
+            $directory === false
+            || $path === false
+            || ! str_starts_with($path, $directory.DIRECTORY_SEPARATOR)
+        ) {
+            return response()->json(['error' => 'Language not found'], 404);
+        }
+
+        return response()->json(json_decode(File::get($path), true));

Source: Laradashboard Commit aa5d33a. The patch introduces a strict [A-Za-z0-9_-]+ allow-list on $lang, resolves the target with realpath(), and verifies the resolved path remains inside resources/lang.

Detection Methods for CVE-2026-105125

Indicators of Compromise

HTTP requests to /api/translations/ containing URL-encoded traversal sequences such as ..%5C, ..%2F, %2E%2E%5C, or %2E%2E%2F.
Access log entries where the {lang} segment contains characters outside [A-Za-z0-9_-].
Response bodies returning JSON content inconsistent with language dictionary structure, such as composer.json package metadata.

Detection Strategies

Deploy web application firewall (WAF) rules that block traversal patterns on requests matching the translations route.
Alert on application-level 200 responses to translations requests where the {lang} parameter contains non-alphanumeric characters.
Correlate web server access logs with LaraDashboard version banners to prioritize alerts on unpatched hosts.

Monitoring Recommendations

Enable verbose request logging on the /api/translations/{lang} endpoint and forward logs to a centralized analytics platform.
Monitor filesystem reads from the PHP-FPM or web server process targeting files outside resources/lang.
Track outbound responses from the endpoint for unusually large or structurally different JSON payloads.

How to Mitigate CVE-2026-105125

Immediate Actions Required

Upgrade LaraDashboard to version 1.4.8 or later, which includes the fix merged in pull request #350.
Audit web server access logs for prior exploitation attempts containing encoded traversal sequences on the translations route.
Rotate any secrets referenced in JSON files that may have been exposed, including dependency pins and configuration metadata.

Patch Information

The fix is published in LaraDashboard Release v1.4.8 and tracked in GitHub Security Advisory GHSA-43jp-66c9-7cgh. The patched TranslationController enforces a strict regex allow-list on the $lang parameter and validates the resolved path with realpath() against the resources/lang base directory. Additional advisory context is available from VulnCheck.

Workarounds

Block or rewrite requests to /api/translations/{lang} at the reverse proxy or WAF layer when the {lang} segment contains characters outside [A-Za-z0-9_-].
Restrict access to the translations endpoint to authenticated users or trusted IP ranges until patching is complete.
On Windows hosts, deny HTTP requests containing %5C or raw backslashes in URL paths at the ingress layer.

bash

# Nginx mitigation example — reject non-alphanumeric {lang} segments
location ~ ^/api/translations/(?<lang>[^/]+)$ {
    if ($lang !~ ^[A-Za-z0-9_-]+$) {
        return 404;
    }
    proxy_pass http://laradashboard_upstream;
}