CVE-2026-90932

LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal flaw (CWE-73) in the core-upgrade backup handling: CoreUpgradeController and BackupService::deleteBackup() concatenate the user-supplied backup_file/filename parameter directly onto the storage/app/core-backups directory path without normalisation, without basename(), and without verifying the resolved path stays inside that directory. An authenticated attacker holding only the delegated settings.edit permission (no Superadmin role required) can supply ../ traversal sequences to delete arbitrary files reachable on the host filesystem, including files outside the application tree, or point the restore operation at a ZIP archive from an arbitrary on-disk location, overwriting application files and achieving remote code execution. The advisory notes the vulnerable concatenation was introduced in the v0.9.7 release line, and no patched version was available at the time of publication. There is no known public PoC, the issue is not in CISA's KEV catalog, and exploitation requires valid credentials with the settings.edit permission, so opportunistic mass exploitation is less likely than targeted abuse by a low-privileged insider or compromised account.

What to do: With no patched version available, immediately audit which accounts hold the delegated settings.edit permission and strip it from anyone who does not strictly need it, reserving the core-upgrade/backup functionality for trusted Superadmin staff. Block or alert on requests to the CoreUpgradeController backup delete/restore endpoints whose backup_file/filename parameters contain ../ sequences or absolute paths (WAF/reverse-proxy virtual patch), or disable those endpoints entirely until a fix ships. Hunt for signs of abuse — unexplained file deletions anywhere on the host, or modified/added files in the application directories indicating a malicious ZIP restore — and rotate credentials and rebuild from trusted sources if tampering is found.