LaraDashboard prior to version 1.4.8 has an open redirect flaw in the email template builder. The vulnerability allows attackers to supply an arbitrary redirect_url parameter to the EmailTemplateController during the builder or builderEdit actions. An untrusted redirect is then performed after a user saves a template, enabling redirection to an external site. This flaw can be leveraged for phishing or social engineering attacks.

The vulnerability affects installations of LaraDashboard running any version earlier than 1.4.8. The affected code resides in the EmailTemplateController and related JavaScript components handling redirect_url.

The CVSS score of 5.3 indicates moderate severity. Because the attack requires crafting a URL and directing a logged‑in user with template permissions to click it, the likelihood of exploitation in the wild is limited but not negligible. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The probable attack vector is a phishing email or message containing the malicious link, which then redirects the victim after they save a template. No advanced privileges or system exploits are required.