Technical impact
The vulnerability arises from insecure concatenation of a user‑supplied backup_file/filename value into the backup directory path without normalisation, without applying basename(), and without ensuring the resolved path remains inside the designated backups directory. An authenticated user with only delegated settings.edit permission can supply traversal sequences, use the CoreUpgradeController or BackupService delete function to delete arbitrary files or restore a ZIP from any location, and write malicious files into the application directories, resulting in remote code execution. This is a Path Traversal flaw (CWE‑73).
Affected Systems
LaraDashboard versions 0.9.2 through 1.2.2 are affected. The vulnerable code is present in the core‑upgrade backup handling shipped up to v1.2.2. Version 1.3.0 includes the fix.
Risk and Exploitability
The CVSS score of 8.6 indicates high severity. The EPSS score is 0.0082, indicating a low but nonzero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authentication but does not need Superadmin; a normal user with delegated settings.edit permission can trigger the exploit. Once the traversal is used to delete or overwrite critical files, an attacker can place a malicious archive that extracts into the application’s directory, leading to remote code execution. A public patch was released in version 1.3.0, mitigating the risk for instances that upgrade, but any deployed instance still running the vulnerable versions remains at risk.
