CVE-2026-90932

Name of the Vulnerable Software and Affected Versions LaraDashboard versions 0.9.2 through 1.2.2

Description A path traversal issue exists in the core-upgrade backup handling. The CoreUpgradeController and BackupService (specifically the deleteBackup() function) concatenate the user-supplied backup file or filename variables directly onto the backup directory path without normalization or verification that the path remains within the intended directory. An authenticated user with settings.edit permissions can use traversal sequences to delete arbitrary files on the host filesystem or restore a ZIP archive from an unauthorized location, which can lead to remote code execution by writing arbitrary files into application directories.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.