Lara Dashboard versions 0.9.2 through 1.3.1 contain a server‑side request forgery flaw in the POST /api/admin/builder/markdown/fetch endpoint. The flaw allows any authenticated user to provide an arbitrary URL, causing the application to make an outbound HTTP request and return the raw response body. Attackers can therefore read data from internal HTTP services, cloud metadata, and even IAM credentials that should remain private. The weakness is a classic examples of CWE‑918 server‑side request forgery.

The vulnerability affects the Laradashboard product. All releases from version 0.9.2 up to and including 1.3.1 are impacted; version 1.3.2 and later incorporate a safe URL validator that prevents arbitrary outbound requests.

The CVSS base score of 7.1 indicates medium‑to‑high severity. EPSS data is currently unavailable and the issue is not listed in the CISA KEV catalog, suggesting it may not yet be widely exploited. The vulnerability requires that the user be authenticated to the application, after which the attacker can issue unrestricted outbound network requests. This makes exploitation straightforward for actors who can log in, such as compromised user accounts or default credentials, and abuse the ability to reach internal services and cloud metadata.