CVE-2026-86436: Laradashboard

Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days.

Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chosen extensions to the public web root and execute code if the deployment permits execution of the uploaded file type.

Affected products

• Laradashboard Laradashboard: before 1.3.2 (fixed in 1.3.2)

Published 2026-09-07. Last modified 2026-09-09.