CVE-2026-105128: LaraDashboard Open Redirect Vulnerability

CVE-2026-105128 Overview

CVE-2026-105128 is an open redirect vulnerability in LaraDashboard versions before 1.4.8. The flaw resides in the EmailTemplateController builder and builderEdit actions, which accept an unvalidated redirect_url parameter. An attacker can craft a builder link and send it to an authenticated user holding email template permissions. When the user saves the template, the application redirects them to an attacker-controlled destination, enabling phishing and credential theft.

The weakness is classified under CWE-601: URL Redirection to Untrusted Site.

Critical Impact
Authenticated admins can be silently redirected from a trusted LaraDashboard origin to attacker-controlled phishing pages, undermining user trust boundaries.

Affected Products

LaraDashboard versions prior to 1.4.8
app/Http/Controllers/Backend/EmailTemplateController.php (builder and builderEdit methods)
resources/js/lara-builder/core/LaraBuilder.jsx client component

Discovery Timeline

2026-10-04 - CVE-2026-105128 published to NVD
2026-10-05 - Last updated in NVD database

Technical Details for CVE-2026-105128

Vulnerability Analysis

LaraDashboard is a Laravel-based admin dashboard. The email template builder accepts a redirect_url query parameter that controls the navigation target after a template is saved. Before version 1.4.8, this parameter was passed through to the client-side LaraBuilder.jsx component and ultimately used as a navigation target without origin validation.

Because the redirect occurs from a trusted authenticated session, the destination URL appears to users to originate from the dashboard. Attackers can abuse this trust to deliver phishing pages, fake login screens, or malware download prompts. The required user interaction is minimal: the victim only needs to click a crafted builder link and save a template.

Root Cause

The root cause is missing validation of the redirect_url input against an allowlist or same-origin policy. The controller methods at EmailTemplateController.php lines 142 and 159 forwarded user-supplied redirect targets into the view layer. The LaraBuilder.jsx component (line 762) then performed the navigation without checking that the URL points to an internal path. External absolute URLs, protocol-relative URLs (//evil.example), and URLs with embedded control characters all passed through unchecked.

Attack Vector

Exploitation requires an authenticated LaraDashboard user with email template permissions. The attacker crafts a URL such as https://victim.example/admin/email-templates/builder?redirect_url=https://phish.example/login and delivers it through email, chat, or an embedded link. When the target opens the builder and saves the template, the browser is redirected to the attacker-controlled site, which can mimic the LaraDashboard login to harvest credentials.

The upstream fix introduces a SafeRedirectValidator helper that only accepts same-origin relative paths and rejects URLs containing control characters or protocol-relative prefixes:

php

<?php

declare(strict_types=1);

namespace App\Support\Security;

class SafeRedirectValidator
{
    /**
     * Return a safe redirect target, or null when the URL must be ignored.
     */
    public function sanitize(?string $url): ?string
    {
        if ($url === null) {
            return null;
        }

        $url = trim($url);

        if ($url === '') {
            return null;
        }

        if (preg_match('/[\\x00-\\x1F\\x7F]/', $url) === 1) {
            return null;
        }

        if (str_starts_with($url, '/') && ! str_starts_with($url, '//')) {
            return $url;
        }

Source: GitHub Commit c08da68

Detection Methods for CVE-2026-105128

Indicators of Compromise

Access log entries containing redirect_url= parameters on routes handled by EmailTemplateController with absolute URLs or protocol-relative values
HTTP referer fields pointing to LaraDashboard builder pages followed by navigation to external, unrelated domains
User reports of unexpected logout screens or re-authentication prompts after saving an email template

Detection Strategies

Review web server and Laravel request logs for builder and builderEdit requests where redirect_url contains http://, https://, or // prefixes
Correlate authenticated admin sessions with outbound navigations to domains outside the organization's allowlist
Hunt for phishing links referencing LaraDashboard email template builder paths in inbound email gateways

Monitoring Recommendations

Enable verbose request logging on all EmailTemplateController routes until the patch is deployed
Alert on any redirect_url parameter value that fails a same-origin check
Monitor identity provider logs for unusual authentication failures or new session creations shortly after email template save events

How to Mitigate CVE-2026-105128

Immediate Actions Required

Upgrade LaraDashboard to version 1.4.8 or later, which introduces the SafeRedirectValidator
Audit administrator and email template permission assignments and remove unneeded grants
Communicate to users that unexpected post-save redirects from the dashboard should be reported

Patch Information

The fix is delivered in GitHub Release v1.4.8 via Pull Request #341 and commit c08da68. The controller now depends on a new SafeRedirectValidator service that returns null for any URL that is not a same-origin relative path. Full technical details are documented in the GitHub Security Advisory GHSA-j2vp-w788-8fcf and the VulnCheck Advisory.

Workarounds

Deploy a web application firewall rule that strips or rejects redirect_url parameters containing absolute URLs on EmailTemplateController endpoints
Restrict access to the email template builder to a narrow set of trusted administrators until the upgrade is applied
Add a reverse-proxy filter that blocks requests where redirect_url begins with http, https, or //

bash

# Example Nginx filter blocking external redirect_url values on the builder route
location ~ ^/admin/email-templates/(builder|builderEdit) {
    if ($arg_redirect_url ~* "^(https?:|//)") {
        return 400;
    }
    proxy_pass http://laradashboard_upstream;
}