LaraDashboard EUVD-2026-77450

Exploitation requires an active authenticated session with the delegated settings.edit permission - a non-Superadmin role that may be granted to regular administrative users or content managers, and is therefore potentially held by multiple accounts in any given deployment. Unauthenticated access is not sufficient, and users without the settings.edit role cannot reach the vulnerable endpoints. The RCE path via ZIP restore additionally requires that a malicious archive exist at a filesystem location readable by the web server process, either placed by the attacker through a separate primitive or pre-existing. The file-deletion path via deleteBackup() has no such secondary prerequisite. Exploitation is limited to files reachable by the OS account under which the web server runs; environments using a tightly scoped service account with minimal filesystem permissions reduce the blast radius of both primitives.

The CVSS 4.0 base score of 8.6 uses PR:H, but the description characterises the required role as a delegated non-superadmin settings.edit user, which is more consistent with PR:L - a distinction that matters because this permission may be widely granted across staff accounts; even a mid-sized municipal IT team in boleslawiec running LaraDashboard as an internal admin portal should treat this as urgent given the combination of RCE potential and confirmed absence of any patch. Attack vector is network (AV:N) and complexity is low (AC:L) once the role is held, making the exploit straightforward for any insider or compromised account. The RCE primitive via ZIP restore elevates this beyond a simple file-deletion bug. No CISA KEV listing and no public exploit code have been identified at time of analysis, providing modest short-term relief, but the detailed public advisory fully documents the exploit mechanism, lowering the bar for independent reproduction. EPSS data is absent from the provided input, so probability-based triage signals are unavailable. The complete absence of a vendor patch means all deployed instances remain unmitigated.

An attacker who controls a LaraDashboard account with the settings.edit role - obtained through phishing, credential reuse, or deliberate assignment - sends a crafted POST request to the backup management endpoint with a filename parameter such as ../../../../var/www/html/shell.php embedded in a restore operation. By placing a malicious ZIP archive at a known path on the host (e.g. via a separate file-upload vector or writable temp directory) and triggering the restore handler with a traversal payload, the ZIP is extracted into the web root, placing a PHP webshell that is immediately executable via a direct HTTP request. No public exploit code has been identified at time of analysis, but the publicly described mechanics are straightforward to implement.