LaraDashboard versions prior to 1.4.8 have a path traversal flaw that lets attackers manipulate the {lang} segment in the /api/translations endpoint to read arbitrary JSON files. The vulnerability is unauthenticated, allowing any user who can reach the API to obtain files such as composer.json and other configuration files. This leads to potential leakage of internal application structure, credentials, or other sensitive information exposed in those files.

The flaw affects the laradashboard:laradashboard product published before version 1.4.8. Any installation running a vulnerable release may be exposed to the path traversal attack.

The CVSS score of 6.3 indicates a moderate severity issue. The EPSS score is currently unavailable, so the market exploitation probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Attackers can execute the exploit by sending a crafted request to /api/translations/{lang} without requiring authentication; on Windows hosts this can be done by encoding backslash sequences such as ..%5C to escape the resources/lang directory and read JSON files.