Unauthorized File Upload Vulnerability in Lara Dashboard by Lara Technologies

CVE-2026-86436

What is CVE-2026-86436?

The Lara Dashboard, up to version 1.3.1, exhibits a vulnerability that permits authenticated users without the necessary content permissions to upload files via the post-builder image and video upload endpoints. This flaw enables attackers to exploit the system, allowing them to upload malicious polyglot files with custom extensions directly to the public web root. If the deployment is configured to execute uploaded file types, this can lead to severe security breaches, including unauthorized code execution.

References