Backpack CRUD CVE-2026-54182
HIGH
GHSA-mrc5-3mm3-45c5
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:N and PR:N because the attack is unauthenticated over the network; AC:H because exec() must be enabled and the reverse proxy must not strip malformed Host headers - both non-default conditions must be simultaneously absent.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Summary
Backpack\CRUD\Stats::makeCurlRequest builds a shell command using unescaped input that originates from the HTTP Host header, then passes it to exec(). A specially crafted Host header can break out of the shell argument and cause the server to execute arbitrary OS commands as the web user.
The vulnerable code path is reached from BackpackServiceProvider::boot() on every HTTP request in production when exec() and curl are available. A 1-in-100 random gate is the only guard - an attacker can reliably trigger it by retrying.
Severity
High - CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Complexity is rated High because default nginx and Apache configurations typically strip or reject malformed Host headers before they reach PHP, and exec() is often disabled for web processes in hardened environments. Both mitigations must be absent for exploitation.
Impact
A successful exploit yields OS command execution as the web server user (www-data, nginx, etc.), giving an unauthenticated attacker access to environment secrets (APP_KEY, database credentials, API keys in .env), the filesystem, and any service the server can reach.
Fix
makeCurlRequest was replaced with the Guzzle-based path already present in the codebase, eliminating the shell-command construction entirely. Upgrade to a patched release immediately.
Affected versions
| Branch | Vulnerable range | First safe version |
|---|---|---|
| 4.1.x | < 4.1.70 | 4.1.70 |
| 5.x | < 5.6.2 | 5.6.2 |
| 6.x | < 6.8.13 | 6.8.13 |
| 7.x | < 7.0.36 | 7.0.36 |
Credits
Reported by Vishal Shukla (@shukla304) via sechub.dev AI Agent.
AnalysisAI
OS command injection in Laravel Backpack CRUD's Stats::makeCurlRequest method allows unauthenticated remote attackers to execute arbitrary OS commands as the web server user by supplying a crafted HTTP Host header. All four maintained branches are affected: 4.1.x before 4.1.72, 5.x before 5.6.2, 6.x before 6.8.13, and 7.x before 7.0.36. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions to be met simultaneously. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) correctly captures a meaningful real-world nuance: Attack Complexity is High because successful exploitation requires two non-default conditions to be simultaneously absent - the application's reverse proxy must not strip or normalize malformed Host headers (standard nginx and Apache configurations do strip these), and PHP's exec() function must be enabled for the web process (many hardened PHP-FPM deployments disable it via disable_functions). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade immediately to the earliest safe release for your installed branch: 4.1.72 for the 4.1.x branch, 5.6.2 for 5.x, 6.8.13 for 6.x, or 7.0.36 for 7.x. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all applications using Laravel Backpack CRUD and their installed versions (4.1.x before 4.1.72, 5.x before 5.6.2, 6.x before 6.8.13, 7.x before 7.0.36); verify network exposure of affected instances and segment critical systems if not yet isolated. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cau
A critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescap
An issue was discovered on GL.iNet devices before version 4.5.0. Rated critical severity (CVSS 9.8), this vulnerability
Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range fi
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Rated critical severity (CVSS 9.8
The STARTTLS implementation in mail/ngx_mail_smtp_handler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and
Same weakness CWE-20 – Improper Input Validation
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today