EUVD-2026-92047
GHSA-px5g-fvm6-m9fr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public /api/translations endpoint
-
ExploitInject URL-encoded ..%5C in {lang} segment
-
ExecutionEscape resources/lang directory
-
ImpactDisclose composer.json or other JSON files
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a LaraDashboard instance before version 1.4.8 with the /api/translations/{lang} endpoint reachable (it is public/unauthenticated, PR:N). The demonstrated escape uses URL-encoded backslash sequences (..%5C) and is described as effective on Windows hosts due to backslash directory-separator handling; the route appends '.json' to the supplied segment, so readable targets are limited to JSON files (e.g. composer.json, version.json) - no arbitrary non-.json file read. Limiting factors: read-only confidentiality impact with no write/execute, Windows-specific nature of the backslash variant, and the encoding/complexity reflected in AC:H/AT:P. No user interaction or authentication is needed. |
| Impact | This is a medium-severity information-disclosure flaw, not a top-tier priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N, 6.3) is internally consistent with the description and source evidence: an unauthenticated network attacker (PR:N/UI:N) can read data, but the only impact is low confidentiality (VC:L) - read access to .json files - with no integrity or availability effect. The elevated attack complexity/requirements (AC:H, AT:P) reflect that the demonstrated escape relies on Windows-specific backslash handling (..%5C) and URL-encoding tricks, so default Linux deployments may be less readily exploitable via the backslash variant (the patch's own tests also cover %2F/%252F forward-slash variants, suggesting broader applicability that the one-impact-metric cannot fully capture - verify platform behavior against the target OS). No EPSS score was provided in the input, the CVE is NOT listed in CISA KEV, and no POC flag was supplied, so there is no signal of active or widespread exploitation. Net: real but low-urgency; patch during normal cycles, prioritizing internet-exposed LaraDashboard instances on Windows. |
| Exploit ScenarioDerived | An unauthenticated attacker locates a public LaraDashboard instance (before 1.4.8) running on a Windows host and requests the translations API with a URL-encoded traversal payload such as /api/translations/..%5C..%5Ccomposer, causing the app to resolve outside resources/lang and return composer.json. No public exploit was identified at time of analysis, though the vendor patch (PR #350) ships regression tests enumerating the exact traversal payloads. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 04, 2026
Path traversal in LaraDashboard before 1.4.8 lets unauthenticated remote attackers read arbitrary JSON files from the application by manipulating the {lang} segment of the public /api/translations/{lang} endpoint. Because the route concatenates the user-supplied value into a filesystem path and appends '.json', an attacker on a Windows host can submit URL-encoded backslash sequences such as ..%5C to escape the resources/lang directory and retrieve files like composer.json or version.json, exposing dependency and version metadata. The impact is limited to confidentiality (read-only, JSON files only) with no write or code execution, and no public exploit code was identified at time of analysis; a vendor fix is available in v1.4.8.
RemediationAI
Upgrade LaraDashboard to 1.4.8 or later; this is the vendor-released patch that introduces Api\TranslationController with strict allow-list validation (^[A-Za-z0-9_-]+$), realpath() resolution and a str_starts_with containment check, plus a where('lang', '[A-Za-z0-9_-]+') route constraint and named route (fix references: https://github.com/laradashboard/laradashboard/pull/350, https://github.com/laradashboard/laradashboard/commit/aa5d33a32ccef07618ae8687247540d73a21505e, release https://github.com/laradashboard/laradashboard/releases/tag/v1.4.8, advisory https://github.com/laradashboard/laradashboard/security/advisories/GHSA-43jp-66c9-7cgh). If upgrading is not immediately possible, block or restrict the /api/translations/{lang} endpoint at the reverse proxy or web server: deny requests whose path or query contains traversal or encoding artefacts ('..', '%2e', '%5c'/'%5C', '%2f'/'%2F', and double-encoded '%252F'/'%252e' variants) and, where the endpoint is not needed by the front end, return 404 for the whole route - the trade-off is that client-side locale loading for the UI will break for legitimate languages. An alternative compensating control is to run the application on a Linux host, where the demonstrated backslash escape does not apply, though forward-slash traversal attempts should still be filtered at the perimeter; hosts running Windows should treat patching as the only robust fix because the backslash separator is a platform behaviour that application-level filtering elsewhere does not reliably cover. Also ensure web-server logs are monitored for encoded backslash or traversal payloads hitting /api/translations/ as an indicator of scanning or exploitation attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
LaraDashboard is a Laravel (PHP) application, and the flaw is a classic CWE-22 path traversal caused by unvalidated input flowing into a filesystem read. In versions before 1.4.8, routes/api.php defined the translation endpoint as an inline closure that built the path resource_path("lang/{$lang}.json") and passed it directly to file_get_contents() with only a file_exists() check, so any value accepted by the router's default route parameter matching was interpolated into the path. The patch (PR #350, commit aa5d33a) replaces the closure with an Api\TranslationController that (1) rejects any {lang} value not matching ^[A-Za-z0-9_-]+$, (2) resolves both resources/lang and the candidate file with realpath(), and (3) enforces containment via str_starts_with($path, $directory.DIRECTORY_SEPARATOR); routes/api.php additionally applies a where('lang', '[A-Za-z0-9_-]+') constraint and names the route api.translations.show. The exploit variant described is Windows-specific because on Windows both / and \ act as directory separators, so a URL-encoded backslash (..%5C) is treated as traversal even where forward-slash filtering or routing behaviour would otherwise interfere; the mandatory '.json' suffix limits readable targets to JSON documents, consistent with the low confidentiality-only impact in the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N, unauthenticated per PR:N).
Know when Laradashboard gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Unauthenticated remote read (PR:N/UI:N), but Windows-specific backslash handling and encoding raise complexity (AC:H); impact limited to low confidentiality of JSON files, no integrity/availability.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the {lang} route segment. On Windows hosts, attackers can send URL-encoded backslash sequences like ..%5C to escape resources/lang and read composer.json or other application JSON files.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
More in Laradashboard
View allImproper privilege management in LaraDashboard before 1.4.8 lets an authenticated Admin-tier user who holds the role.edi
LaraDashboard is an all-In-one solution to start a Laravel Application. In 2.3.0 and earlier, the password reset flow tr
Authentication bypass in Lara Dashboard before 1.3.0 lets unauthenticated attackers log in as any registered user by req
Information disclosure in LaraDashboard before 1.4.8 allows an authenticated user who holds only the low-privilege setti
Server-side request forgery in Lara Dashboard 0.9.2-1.3.1 allows any authenticated content editor to proxy arbitrary HTT
Unauthenticated attackers can exhaust LaraDashboard's paid email-verification quota through the public forgot-password a
Race condition in LaraDashboard 1.4.0 through 1.4.7 allows unauthenticated remote attackers to bypass the per-IP daily r
Open redirect in LaraDashboard before 1.4.8 allows remote attackers to steer an authenticated user who holds email-templ
Exploit-DB