Is CVE-2026-105125 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-105125?

CVE-2026-105125 has a CVSS v3 severity of LOW (3.7).

Back

CVE-2026-105125

Description

LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the {lang} route segment. On Windows hosts, attackers can send URL-encoded backslash sequences like ..%5C to escape resources/lang and read composer.json or other application JSON files.