CVE-2026-90932 laradashboard CVE debrief

Who should care

Defenders responsible for LaraDashboard instances, particularly those with delegated settings.edit permissions, should assess exposure and prioritize patching or mitigation. This includes reviewing system logs for potential exploitation attempts and ensuring that only authorized users have access to the CoreUpgradeController and BackupService. Additionally, defenders should verify that the instance is running a patched version and restrict access to the .

Why it matters

CVE-2026-90932 is a path traversal vulnerability in LaraDashboard that allows for remote code execution and arbitrary file deletion. Defenders should prioritize verifying exposure and applying patches or mitigations.

• Remote code execution is possible for authenticated users with delegated settings.edit permissions.
• Arbitrary file deletion is possible for authenticated users with delegated settings.edit permissions.
• Restoration of ZIP archives from arbitrary on-disk locations can lead to remote code execution.

Technical summary

The vulnerability is caused by the insecure concatenation of user-supplied backup_file/filename values directly onto the backup directory path without normalization or verification. An authenticated user with the delegated settings.edit permission can supply ../ traversal sequences to delete arbitrary files reachable on the host filesystem or restore a ZIP archive from an arbitrary on-disk location, achieving remote code execution.

Defensive priority

Defenders should prioritize verifying exposure and applying patches or mitigations, as the vulnerability allows for remote code execution.

Recommended defensive actions

• Verify exposure by checking if the LaraDashboard instance is running a vulnerable version (0.9.2 through 1.2.2) and if the settings.edit permission is delegated to any users.
• Apply patches or mitigations as soon as they become available, as the vendor has not provided a patched version yet.
• Restrict access to the CoreUpgradeController and BackupService to prevent unauthorized users from exploiting the vulnerability.
• Monitor for suspicious activity, such as unusual file deletions or restorations, that may indicate exploitation.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is caused by the insecure concatenation of user-supplied backup_file/filename values directly onto the backup directory path without normalization or verification. The advisory states the vulnerable concatenation was introduced in the v0.9.7 release line. No patched version was available at the time of publication.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.