The vulnerability arises from insecure concatenation of a user‑supplied backup file name into the backup directory path without normalisation or boundary checks. An authenticated user with only the delegated settings.edit permission can craft a traversal string and invoke the CoreUpgradeController or BackupService delete function, causing deletion of arbitrary filesystem files or extraction of a ZIP archive at any chosen host location. The resulting write of malicious code into application directories enables remote code execution. The weakness is categorized as Path Traversal (CWE‑73).

LaraDashboard versions 0.9.2 through 1.2.2 are affected. The vulnerable code is present in the core‑upgrade backup handling shipped up to v1.2.2. No patched version exists at the time of the advisory.

The CVSS score of 8.6 indicates high severity. No EPSS data are available, and the vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires authentication but does not need Superadmin; a normal user with delegated settings.edit permission can trigger the exploit. Once the traversal is used to delete or overwrite critical files, an attacker can place a malicious archive that extracts into the application’s directory, leading to remote code execution. The lack of a public patch and the broad impact on file system integrity make this a serious threat for any deployed instance that still runs the vulnerable versions.