Backpack CRUD CVE-2026-54177
MEDIUM
GHSA-8q2w-pv9p-mjvc
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Upload delivered over HTTP (AV:N); multiple non-default deployment conditions required (AC:H); explicit admin authentication prerequisite (PR:H); full RCE yields C:H/I:H/A:H with no scope change.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Summary
HasUploadFields (used via CrudTrait on Backpack-managed models) and the withFiles() uploader preserve the client-supplied file extension without validation. On installations using a public disk with php artisan storage:link, this allows an authenticated administrator to upload a file with a server-executable extension that the web server will pass to the PHP interpreter - if no MIME or other type of upload validation is present.
Details
The uploadFileToDisk and uploadMultipleFilesToDisk methods hash the filename stem but write the client-supplied extension to disk verbatim - no allowlist, blocklist, or MIME check is applied inside the trait itself.
The newer withFiles() path (via FileNameGenerator) resolves the extension from the file's MIME type rather than the client filename, but also does not block server-executable types.
Applications that follow the Backpack quickstart without adding explicit mimes: or mimetypes: validation rules in their form requests are affected.
Impact
An authenticated administrator with access to an upload-enabled CRUD panel, on a site using the public disk with web-accessible storage and no MIME type validation, can upload a server-executable file and achieve remote code execution.
Conditions required for exploitation:
- Authenticated admin access to a Backpack CRUD panel
- An upload field with no
mimes:/mimetypes:validation rule - The
publicdisk in use (standard pattern for web-visible uploads) php artisan storage:linkin place- A web server + PHP-FPM stack (default on most hosts)
Fix
A denylist for server-executable extensions has been added to both HasUploadFields and FileNameGenerator. Image-typed fields now additionally enforce an allowlist. This is defence-in-depth - it does not replace application-level validation.
Recommended developer action
Review all upload fields and add explicit mimes: or mimetypes: validation in your form requests or field definitions. Refer to the Backpack field documentation for examples.
---
Reported by Vishal Shukla (@shukla304) via sechub.dev.
AnalysisAI
Remote code execution in Laravel Backpack CRUD's upload handling allows authenticated administrators to place PHP webshells in web-accessible storage by exploiting the lack of file extension validation inside HasUploadFields and FileNameGenerator. Affected are installations on the 6.x series before 6.8.14 and the 7.x series before 7.0.38 where the public disk with storage:link is in use and no explicit mimes: or mimetypes: Laravel validation rule guards upload fields - conditions common in quickstart-following deployments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all five of the following conditions to hold simultaneously: (1) the attacker possesses authenticated administrator credentials to a Backpack CRUD panel - unauthenticated or standard-user access is insufficient (CVSS PR:H); (2) at least one upload field in that panel lacks an explicit `mimes:` or `mimetypes:` Laravel validation rule in its form request or field definition; (3) the Laravel application is configured to use the `public` disk for file storage; (4) `php artisan storage:link` has been executed, creating a symlink that exposes `storage/app/public` under the web root at `/storage`; and (5) the web server stack (Apache or nginx with PHP-FPM) is configured to execute PHP files served from that storage path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 score is 6.6 (Medium) with vector AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade `backpack/crud` to version 6.8.14 (6.x series) or 7.0.38 (7.x series) via `composer update backpack/crud`; exact release tags are confirmed at https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14 and https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38, and the underlying fix is in PR #5993 (https://github.com/Laravel-Backpack/CRUD/pull/5993). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today