CVE-2026-54179

Received Received - Intake

Stored XSS in Backpack CRUD via Unvalidated Data URI

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: GitHub, Inc.

Description

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/SingleBase64Image.php methods SingleBase64Image::uploadFiles and SingleBase64Image::uploadRepeatableFiles, used by image fields through withFiles(), accept any data URI beginning with data:image without validating the declared MIME subtype or decoded bytes, while src/app/Library/Uploaders/Support/FileNameGenerator.php method FileNameGenerator::getExtensionFromFile applies mime_content_type() to the data URI instead of the decoded content. An authenticated administrator can therefore store arbitrary file content under an extensionless filename on the configured disk, which can cause stored cross-site scripting or other unintended behavior when the file is served and accessed. This issue is fixed in version 7.0.38 and 6.8.14.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-08-31

Generated

2026-09-01

AI Q&A

2026-09-01

EPSS Evaluated

N/A

NVD

CVE-2026-54179

Affected Vendors & Products

Vendor	Product	Version / Range
backpack	crud	From 6.0.0 (inc) to 6.8.14 (inc)
backpack	crud	From 7.0.37 (inc)
backpack	crud	7.0.38
backpack	crud	6.8.14

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability exists in backpack/crud versions 6.0.0 to 6.8.14 and 7.0.37. It allows authenticated administrators to upload arbitrary file content with an extensionless filename by exploiting improper validation of data URIs in image fields. The system accepts data URIs starting with data:image without checking the MIME subtype or decoded bytes, leading to potential malicious file storage.

Detection Guidance

Check installed versions of backpack/crud. If using versions between 6.0.0-6.8.14 or 7.0.0-7.0.37, the system is vulnerable. Inspect files in src/app/Library/Uploaders/ for SingleBase64Image.php and FileNameGenerator.php to confirm the presence of the vulnerable methods.

Impact Analysis

An attacker with admin access could upload malicious files that bypass security checks, potentially leading to stored cross-site scripting (XSS) attacks when files are accessed. This could allow unauthorized code execution, data theft, or other malicious activities depending on how the files are used in the application.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements for protected health information. Organizations using affected versions may face compliance violations if exploited.

Mitigation Strategies

Upgrade backpack/crud to version 7.0.38 or 6.8.14 immediately. If upgrading is not possible, restrict access to the admin panel and disable image uploads via withFiles() until patched.

Hi! I’m here to help you understand CVE-2026-54179. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70