Path Traversal Vulnerability in LaraDashboard Affects Unauthenticated Access
CVE-2026-105125

6.3MEDIUM

Key Information:

Vendor

Laradashboard

Status
Laradashboard
Vendor
CVE Published:
3 October 2026

What is CVE-2026-105125?

LaraDashboard versions prior to 1.4.8 are susceptible to a path traversal vulnerability that can be exploited by unauthenticated attackers. By manipulating the {lang} route segment, malicious users can access sensitive JSON files, including composer.json, by using URL-encoded backslash sequences like ..%5C on Windows systems. This vulnerability can lead to unauthorized disclosure of information, making it crucial for users to update to version 1.4.8 or later to mitigate the risk.

Affected Version(s)

laradashboard 0 < 1.4.8

laradashboard 1.4.8

References

https://github.com/laradashboard/laradashboard/security/a...
vendor-advisory
https://github.com/laradashboard/laradashboard/blob/v1.4....
technical-description
https://github.com/laradashboard/laradashboard/pull/350
patchissue-tracking

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

EVIL0RD
.