The vulnerability arises because the POST /admin/settings/core-upgrades/upload endpoint in Lara Dashboard before 1.3.2 authorizes uploads solely with the settings.edit permission. Non‑Superadmin administrators can therefore upload and extract arbitrary zip archives that overwrite live application source code, including files such as routes/web.php. If an uploaded archive contains malicious PHP or other server‑side code, it is executed as the web server user, providing the attacker access to environment secrets and database credentials. This flaw maps to CWE‑863: Incorrect Authorization.

The affected product is Laradashboard:laradashboard, specifically all releases prior to 1.3.2. This includes version 1.3.1 and earlier versions. Users running these versions of the application, which expose the core‑upgrade upload endpoint, are susceptible without the workaround or fix.

The CVSS score of 8.6 categorizes this issue as high severity. While EPSS data is not available, the vulnerability has the potential for exploitation because it requires only a legitimate administrator account with settings.edit permissions, which many installations grant to non‑Superadmin users. The issue is not listed in the CISA KEV catalog, but the attack path is straightforward and the exploitation conditions are minimal, making it a significant risk for any affected deployment.