Description

Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chosen extensions to the public web root and execute code if the deployment permits execution of the uploaded file type.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-07T22:17:21.833Z",
  "pubdate": "2026-09-07T22:17:21.833Z",
  "executiveSummary": "Lara Dashboard versions prior to 1.3.2 contain an improper authorization vulnerability within the post-builder image and video upload endpoints.\nThe flaw allows authenticated users, regardless of their assigned content management permissions, to interact with restricted upload functionality.\nThis vulnerability exposes the application to arbitrary file uploads, potentially enabling remote code execution (RCE) if the web server is configured to execute files placed within the public document root.\nAttackers can leverage this to upload polyglot files containing malicious payloads disguised with arbitrary extensions, bypassing intended security constraints.\nThe risk is critical, as it bypasses authorization logic and grants unauthorized users the ability to place executable files on the server's filesystem.\nExploitation requires a valid authenticated session, although the attacker does not need high-level administrative privileges for content management.",
  "technicalDetails": "The vulnerability resides in the post-builder module of Lara Dashboard, specifically within the backend controllers managing image and video upload requests. The root cause is a failure to enforce authorization checks (middleware) on these specific endpoints, which allows any authenticated user to trigger the file upload process.\nUnder normal circumstances, these endpoints should be restricted to users possessing specific content creation or management privileges. However, the application logic fails to validate the current user's session against these required permission scopes, effectively treating unauthorized authenticated requests as legitimate.\nThe exploitation flow begins with an authenticated user crafting a malicious HTTP POST request targeted at the post-builder upload endpoints. Because the application does not validate user permissions, the server proceeds to accept the file stream. An attacker can craft polyglot files—files that appear as valid media (images or videos) but contain executable code fragments—and assign them arbitrary extensions allowed by the server's validation logic.\nUpon successful submission, these files are saved to the public web root. If the underlying server environment (e.g., Apache with PHP-FPM or Nginx with improper handler configurations) is misconfigured to interpret or execute files based on the uploaded extensions, the attacker can trigger code execution by requesting the file directly via its URI.\nThe attack is facilitated by the lack of input sanitization and file type verification at the application layer, allowing for the circumvention of intended upload restrictions. Furthermore, because the files are stored in a publicly accessible directory, the persistence of the uploaded payload is trivial, potentially allowing the attacker to maintain a backdoor on the compromised system.\nThe vulnerability affects all versions of Lara Dashboard prior to 1.3.2. Remediation requires ensuring that appropriate authorization middleware is applied to all sensitive upload endpoints to verify user identity and role-based access control (RBAC) permissions before processing any file input."
}