rootpwn

medium · CVSS v3 3.7 · CVSS v4 6.3 · EPSS 0.0031

CVE-2026-105125

LaraDashboard versions prior to 1.4.8 allow unauthenticated path traversal via the {lang} route, enabling attackers to read arbitrary JSON f

Overview

LaraDashboard versions prior to 1.4.8 allow unauthenticated path traversal via the {lang} route, enabling attackers to read arbitrary JSON files on Windows hosts. The flaw is triggered by URL-encoded backslash sequences that escape the resources/lang directory. This can expose sensitive configuration files such as composer.json.

Description

LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the {lang} route segment. On Windows hosts, attackers can send URL-encoded backslash sequences like ..%5C to escape resources/lang and read composer.json or other application JSON files.

Impact

Confidentiality is compromised as attackers can read application JSON files, potentially revealing sensitive data. Integrity and availability are not directly affected. Defenders of Windows-based LaraDashboard installations should be aware that unauthenticated users can access these files.

Remediation

Apply the official patch to upgrade to version 1.4.8 or later. If upgrading is not possible, restrict access to the /resources/lang path via web‑server configuration and validate the {lang} parameter to disallow backslash or dot sequences. Additionally, configure the application to prevent file reads outside the intended directory.

Risk context

The vulnerability has a medium CVSS v3 score of 3.7 and a low EPSS of 0.0031, indicating a modest likelihood of exploitation. While the risk is not high, defenders should still address it promptly to prevent potential data leakage.

Affected products

  • LaraDashboard 1.4.7
  • LaraDashboard 1.4.6
  • LaraDashboard 1.4.5
  • LaraDashboard 1.4.4
  • LaraDashboard 1.4.3
  • LaraDashboard 1.4.2
  • LaraDashboard 1.4.1
  • LaraDashboard 1.4.0

Scores

Severity
medium
CVSS v2
2.6
CVSS v3
3.7
CVSS v4
6.3
EPSS
0.0031

path-traversal unauthenticated Windows LaraDashboard file-read medium-severity

← All CVEs

Related CVEs

medium

CVE-2026-105144

A flaw has been found in Drogon up to 1.9.13-1/10.0-beta.3 on Windows. Affected is the function StaticFileRouter::route of the file lib/src/StaticFileRouter.cc of the component Static File Router. Executing a manipulation can lead to path traversal. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

medium

CVE-2026-105205

SiYuan versions prior to 3.8.5 allow publish‑mode readers to retrieve backlink block IDs and reference counts from password‑protected or publish‑disabled documents via API calls. This exposes hidden metadata that should remain confidential. The flaw is exploitable by sending POST requests to /api/block/getDocInfo or getDocsInfo for a published document ID.

View analysis

medium

CVE-2026-97927

The CVE-2026-97927 flaw in the Linux kernel’s UFS filesystem causes an oops during mount teardown when cylinder group reading fails, potentially crashing the kernel. It occurs only when a writable UFS image has a corrupted first cylinder group. The issue is mitigated by applying the kernel patch that reorders root dentry creation.

View analysis

medium

CVE-2026-105096

CVE-2026-105096 is an authorization bypass vulnerability in the Customer Profile API of Omega Solution CoinEx Crypto 2025. By manipulating the ID parameter in the /customer/ endpoint, an attacker can gain unauthorized access to customer data. The flaw is exploitable remotely and has been publicly disclosed.

View analysis