{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/lara-dashboard--1.3.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-86437"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Lara Dashboard (\u003c 1.3.2)"],"_cs_severities":["high"],"_cs_tags":["web-application-vulnerability","rce","file-upload"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eLara Dashboard versions before 1.3.2 contain an authorization flaw in the /admin/settings/core-upgrades/upload endpoint. The application incorrectly restricts access to this endpoint to the 'settings.edit' permission rather than enforcing 'Superadmin' status. This vulnerability allows an authenticated administrator with limited permissions to upload and extract arbitrary ZIP archives. By crafting a malicious archive, an attacker can overwrite critical application files, such as 'routes/web.php', with payloads containing system commands. These commands execute in the context of the web server user, providing the attacker with full control over the application environment, including access to database credentials and environment secrets. This attack allows for persistence and full system compromise, impacting the confidentiality, integrity, and availability of the host application.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the Lara Dashboard using valid administrative credentials that possess the 'settings.edit' permission.\u003c/li\u003e\n\u003cli\u003eAttacker navigates to the core-upgrades administrative panel within the dashboard interface.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious ZIP archive containing weaponized PHP files designed to overwrite existing application source code.\u003c/li\u003e\n\u003cli\u003eAttacker performs an HTTP POST request to '/admin/settings/core-upgrades/upload' containing the malicious ZIP archive.\u003c/li\u003e\n\u003cli\u003eThe application validates the 'settings.edit' permission and proceeds to extract the archive to the web application's root directory.\u003c/li\u003e\n\u003cli\u003eThe uploaded malicious PHP files overwrite legitimate application source code, such as 'routes/web.php'.\u003c/li\u003e\n\u003cli\u003eAttacker triggers the execution of the injected code by requesting the modified PHP file via a browser or script.\u003c/li\u003e\n\u003cli\u003eArbitrary system commands are executed with the privileges of the web server user, resulting in credential exfiltration or full system compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to full remote code execution, enabling attackers to extract sensitive environment secrets, access database credentials, and gain persistence on the server. The target is the Lara Dashboard application, specifically affecting installations prior to version 1.3.2.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the upgrade of all Lara Dashboard instances to version 1.3.2 or later to address the insufficient authorization check on the file upload endpoint.\u003c/p\u003e\n","date_modified":"2026-09-07T23:37:52Z","date_published":"2026-09-07T23:37:52Z","id":"https://feed.craftedsignal.io/briefs/2026-09-lara-dashboard-rce/","summary":"Lara Dashboard versions prior to 1.3.2 are vulnerable to arbitrary file upload via the core-upgrades endpoint, allowing unauthorized administrators to achieve remote code execution.","title":"Arbitrary File Upload and RCE in Lara Dashboard","url":"https://feed.craftedsignal.io/briefs/2026-09-lara-dashboard-rce/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:lara_dashboard_project:lara_dashboard:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-86184"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Lara Dashboard (\u003c 1.3.0)","Lara Dashboard (\u003c 1.3.2)","Lara Dashboard (\u003c= 1.3.1)"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","authorization-bypass","remote-code-execution","web-application","ssrf","cve-2026-87821"],"_cs_type":"advisory","_cs_vendors":["Lara Dashboard"],"content_html":"\u003cp\u003eLara Dashboard versions prior to 1.3.0 contain an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by specifying their email address. This vulnerability is active when the application environment (APP_ENV) is configured to anything other than 'production'. By sending a crafted GET request to the /screenshot-login/{email} endpoint, an unauthenticated attacker can obtain a fully authenticated session for the specified user account. This provides the attacker with immediate access to sensitive system administration panels, application settings, and database contents. Furthermore, the elevated access granted by this bypass allows for the use of the module installer to execute arbitrary code on the underlying server, presenting a significant risk to organizational infrastructure.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full account takeover of any user, including administrative accounts. Attackers can leverage this access to exfiltrate sensitive data from the database, modify system configurations, and achieve remote code execution via legitimate management modules. This vulnerability exposes the entire application instance to total compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Lara Dashboard to version 1.3.0 or later immediately to resolve CVE-2026-86184.\u003c/li\u003e\n\u003cli\u003eEnsure the production application environment is explicitly set to 'production' (APP_ENV=production) in all deployment configurations to disable the vulnerable debug/development route.\u003c/li\u003e\n\u003cli\u003eAudit access logs for unauthorized GET requests to the /screenshot-login/ path, especially those originating from external or untrusted network segments.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-09T12:58:02Z","date_published":"2026-09-05T13:31:30Z","id":"https://feed.craftedsignal.io/briefs/2026-09-lara-dashboard-auth-bypass/","summary":"Lara Dashboard versions prior to 1.3.0 are vulnerable to an authentication bypass in the screenshot-login route that permits unauthenticated access to any user account when APP_ENV is not set to production.","title":"Authentication Bypass in Lara Dashboard","url":"https://feed.craftedsignal.io/briefs/2026-09-lara-dashboard-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Lara Dashboard (\u003c 1.3.2)","version":"https://jsonfeed.org/version/1.1"}