CVE-2026-90932: LaraDashboard Path Traversal Vulnerability

CVE-2026-90932 Overview

CVE-2026-90932 is a path traversal vulnerability [CWE-73] in LaraDashboard versions 0.9.2 through 1.2.2. The flaw resides in the core-upgrade backup handling logic, specifically the CoreUpgradeController and BackupService components. An authenticated user with only the delegated settings.edit permission can supply ../ traversal sequences in the backup_file or filename parameter. This allows arbitrary file deletion anywhere on the host filesystem or restoration of an attacker-controlled ZIP archive from an arbitrary on-disk location, leading to remote code execution.

Critical Impact
Attackers with low-privileged dashboard access can achieve remote code execution by writing arbitrary files into application directories through malicious ZIP restore operations.

Affected Products

LaraDashboard 0.9.2 through 1.2.2
LaraDashboard 0.9.7 release line (where the vulnerable concatenation was introduced)
No patched version was available at the time of publication

Discovery Timeline

2026-09-14 - CVE-2026-90932 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90932

Vulnerability Analysis

The vulnerability stems from unsafe path construction in the core-upgrade backup workflow. The BackupService::deleteBackup() method concatenates the user-supplied backup_file or filename value directly onto the backup directory path. The code performs no normalisation, does not apply basename(), and never verifies that the resolved path stays inside storage/app/core-backups.

The corresponding form requests validate the value only as a bounded string. String length checks do not prevent directory traversal characters from reaching the filesystem operation. This gap between input validation and filesystem enforcement is the root of the exploit chain.

Exploitation requires authenticated access with the settings.edit permission. Notably, this permission is delegated and does not require Superadmin privileges, expanding the pool of potential attackers within a compromised or malicious insider scenario.

Root Cause

The root cause is missing path canonicalization on user-controlled input used in filesystem operations. The application trusts the request parameter to represent a filename inside a fixed directory. Without basename() extraction or a realpath() containment check against storage/app/core-backups, ../ sequences resolve to arbitrary locations on the host.

Attack Vector

An authenticated attacker holding the settings.edit permission issues a request to the core-upgrade backup delete or restore endpoint. Supplying a backup_file value such as ../../../../etc/some_target_file triggers deletion of files outside the application tree. Supplying a path to an attacker-staged ZIP archive triggers a restore operation that writes arbitrary files into the application directories, including PHP files reachable by the web server, achieving remote code execution.

Refer to the GitHub Security Advisory and the VulnCheck Path Traversal Advisory for the full technical write-up.

Detection Methods for CVE-2026-90932

Indicators of Compromise

HTTP requests to LaraDashboard core-upgrade endpoints containing ../ or URL-encoded %2e%2e%2f sequences in the backup_file or filename parameter
Unexpected file deletions outside storage/app/core-backups, particularly targeting configuration files, logs, or .env
New or modified PHP files in application directories following a backup restore action
Access log entries showing settings.edit-scoped users invoking backup delete or restore operations at unusual frequencies

Detection Strategies

Inspect web server and Laravel logs for backup endpoint invocations that include traversal sequences in request bodies
Correlate backup restore actions with subsequent web shell indicators such as new .php files under public/ or resources/views/
Flag any invocation of BackupService::deleteBackup() where the resolved path falls outside the expected backup directory

Monitoring Recommendations

Enable file integrity monitoring on the LaraDashboard application root and storage/app/core-backups
Alert on write or delete events initiated by the PHP-FPM or web server process user outside expected directories
Audit accounts holding the settings.edit permission and log every backup management action for review

How to Mitigate CVE-2026-90932

Immediate Actions Required

Restrict the settings.edit permission to trusted administrators until a patched release is available
Disable or block network access to the LaraDashboard core-upgrade backup delete and restore endpoints at the reverse proxy
Audit the backup directory and application tree for unexpected file deletions or newly written PHP files
Rotate credentials and session tokens for any account with settings.edit if compromise is suspected

Patch Information

No patched version was available at the time of publication. Monitor the LaraDashboard GitHub Security Advisory for release updates and apply the fixed version as soon as the maintainers publish it.

Workarounds

Deploy a reverse proxy rule that rejects requests to backup endpoints containing .., %2e%2e, or absolute path prefixes
Apply strict filesystem permissions so the web server process cannot write to or delete files outside storage/app/core-backups
Remove the settings.edit permission from all non-Superadmin roles until an upstream fix is released
Place the LaraDashboard admin interface behind VPN or IP allow-listing to limit exposure of authenticated endpoints

bash

# Example nginx rule to block traversal in backup parameters
location ~* /(core-upgrade|backup) {
    if ($args ~* "(\.\./|%2e%2e)") { return 403; }
    if ($request_body ~* "(\.\./|%2e%2e)") { return 403; }
}