CVE-2026-54177
Received Received - Intake

Remote Code Execution in Backpack CRUD Laravel Package

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, HasUploadFields methods uploadFileToDisk and uploadMultipleFilesToDisk, used through CrudTrait, and the withFiles() path through FileNameGenerator do not internally reject server-executable file types. An authenticated administrator can achieve remote code execution by using an upload-enabled CRUD field without mimes: and mimetypes: validation when the public disk is web-accessible through php artisan storage:link and the web-server and PHP-FPM configuration executes the stored extension. The legacy path preserves an accepted extension and the newer path derives an extension without blocking dangerous types. The package-level restriction is defense in depth and does not replace application-level upload validation. This issue is fixed in versions 6.8.14 and 7.0.38.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-54177
EUVD
EUVD-2026-77719

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
backpack crud From 6.0.0 (inc) to 6.8.14 (inc)
backpack crud 7.0.38
laravel_backpack crud to 6.8.14 (exc)
laravel_backpack crud to 7.0.38 (exc)
laravel_backpack crud 6.8.14
laravel_backpack crud 7.0.38

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in backpack/crud allows authenticated administrators to upload files with server-executable extensions (like PHP, Python, or shell scripts) without proper validation. The package fails to block dangerous file types in upload fields, enabling remote code execution if the public disk is web-accessible and the server executes PHP files.

Detection Guidance

Check for uploaded files with dangerous extensions like .php, .phtml, .pl, .py, .jsp, .cgi, or .sh in your Laravel storage directory, especially under public disk links created by php artisan storage:link. Review CrudTrait and FileNameGenerator classes for improper extension handling.

Impact Analysis

An attacker with admin access could upload malicious files to execute arbitrary code on your server. This could lead to full system compromise, data theft, or further network infiltration. The impact depends on server configuration and whether public disk access is enabled.

Compliance Impact

This vulnerability could violate compliance requirements for data protection (GDPR, HIPAA) by enabling unauthorized code execution, leading to data breaches or loss of sensitive information. Proper file validation and access controls are critical for maintaining regulatory compliance.

Mitigation Strategies

Upgrade to versions 6.8.14 or 7.0.38 or later. Ensure all upload fields include mimes: and mimetypes: validation. Disable public disk links if not needed. Review server and PHP-FPM configurations to prevent execution of uploaded files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54177. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart