CVE-2026-105125: Laradashboard

Low severity, CVSS 3.7. EPSS: 0.3% chance of exploitation in the next 30 days.

LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the {lang} route segment. On Windows hosts, attackers can send URL-encoded backslash sequences like ..%5C to escape resources/lang and read composer.json or other application JSON files.

Affected products

• Laradashboard Laradashboard: before 1.4.8 (fixed in 1.4.8)

Published 2026-10-04. Last modified 2026-10-05.