Lara Dashboard releases before 1.3.2 lack an authorization check on the post‑builder image and video upload endpoints. Any authenticated user, regardless of content‑creation permissions, can upload files to the public web root. The flaw allows uploading polyglot files with attacker‑chosen extensions, enabling code execution on the server if the deployment environment permits execution of that file type. This represents a classic missing‑authorization problem (CWE‑862).

The vulnerable product is Laradashboard (laradashboard:laradashboard). All releases older than version 1.3.2—including the 1.3.1 release—contain the flaw. The issue resides in the routes/web.php upload routes and is handled by the Backend/PostController. No other product or vendor is affected by this specific vulnerability.

The CVSS base score is 5.3, categorizing the flaw as medium severity. Attackers need only an authenticated account, which is often easily obtained in many deployments. Once authenticated, they can upload arbitrary files to the web root, and if the web server allows the uploaded type to execute, arbitrary code can run with the application’s privileges. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, yet the combination of missing authorization and potential code execution presents a notable operational risk.