CVE-2026-105128
5.4 MEDIUMpublic exploit availablePublished 2026-10-04 · Updated 2026-10-05
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
LaraDashboard before 1.4.8 contains an open redirect vulnerability that allows remote attackers to redirect users by supplying an unvalidated redirect_url parameter to EmailTemplateController builder and builderEdit. Attackers can send crafted builder links to logged-in users with email template permissions so saving a template navigates them to attacker-controlled phishing sites.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-601
Public exploit & PoC references
- https://github.com/laradashboard/laradashboard
- https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Controllers/Backend/EmailTemplateController.php#L142
- https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Controllers/Backend/EmailTemplateController.php#L159
- https://github.com/laradashboard/laradashboard/blob/v1.4.2/resources/js/lara-builder/core/LaraBuilder.jsx#L762
- https://github.com/laradashboard/laradashboard/commit/c08da68236267afc0c0073598f66fadbc1b53b66
- https://github.com/laradashboard/laradashboard/pull/341
- https://github.com/laradashboard/laradashboard/releases/tag/v1.4.8
- https://github.com/laradashboard/laradashboard/security/advisories/GHSA-j2vp-w788-8fcf
- https://github.com/laradashboard/laradashboard/security/advisories/GHSA-j2vp-w788-8fcf
All references
- https://github.com/laradashboard/laradashboard
- https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Controllers/Backend/EmailTemplateController.php#L142
- https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Controllers/Backend/EmailTemplateController.php#L159
- https://github.com/laradashboard/laradashboard/blob/v1.4.2/resources/js/lara-builder/core/LaraBuilder.jsx#L762
- https://github.com/laradashboard/laradashboard/commit/c08da68236267afc0c0073598f66fadbc1b53b66
- https://github.com/laradashboard/laradashboard/pull/341
- https://github.com/laradashboard/laradashboard/releases/tag/v1.4.8
- https://github.com/laradashboard/laradashboard/security/advisories/GHSA-j2vp-w788-8fcf
- https://www.vulncheck.com/advisories/laradashboard-before-1.4.8-open-redirect-via-email-template-builder-redirect-url
- https://github.com/laradashboard/laradashboard/security/advisories/GHSA-j2vp-w788-8fcf
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2024-58389PoC
- MEDIUMCVE-2024-58398PoC
- MEDIUMCVE-2026-100523PoC
- CRITICALCVE-2026-101090PoC
- MEDIUMCVE-2026-101151
- HIGHCVE-2026-101152
- UNSCOREDCVE-2026-101907PoC
- MEDIUMCVE-2026-102090PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.