CVE-2026-105128: Laradashboard

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

LaraDashboard before 1.4.8 contains an open redirect vulnerability that allows remote attackers to redirect users by supplying an unvalidated redirect_url parameter to EmailTemplateController builder and builderEdit. Attackers can send crafted builder links to logged-in users with email template permissions so saving a template navigates them to attacker-controlled phishing sites.

Affected products

• Laradashboard Laradashboard: before 1.4.8 (fixed in 1.4.8)

Published 2026-10-04. Last modified 2026-10-05.