CVE-2026-54182
Received Received - Intake

Command Injection in Backpack CRUD

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest in src/Stats.php is reached from BackpackServiceProvider::boot() and constructs a shell command with a URL influenced by the HTTP Host header, which it passes to exec() without adequate shell neutralization. An unauthenticated attacker whose malformed Host value reaches PHP can inject operating-system commands when exec() and curl are available and the 1-in-100 random gate is reached. Repeated requests can reach the random gate. Successful exploitation executes commands as the web-server user, exposing environment secrets, files, and reachable services and permitting data modification or service disruption. Common reverse-proxy Host validation and hardened PHP configurations that disable exec() reduce reachability but do not correct the vulnerable construction. This issue is fixed in versions 4.1.70, 5.6.2, 6.8.13, and 7.0.36.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-54182
EUVD
EUVD-2026-77707

Affected Vendors & Products

Showing 12 associated CPEs
Vendor Product Version / Range
backpack crud to 4.1.70 (inc)
backpack crud to 5.6.2 (inc)
backpack crud to 6.8.13 (inc)
backpack crud to 7.0.36 (inc)
laravel-backpack crud to 4.1.71 (exc)
laravel-backpack crud to 5.6.1 (exc)
laravel-backpack crud to 6.8.12 (exc)
laravel-backpack crud to 7.0.35 (exc)
laravel-backpack crud 4.1.72
laravel-backpack crud 5.6.2
laravel-backpack crud 6.8.13
laravel-backpack crud 7.0.36

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an OS command injection vulnerability in the Laravel-Backpack CRUD package. It occurs in the Stats::makeCurlRequest method, which constructs a shell command using unescaped input from the HTTP Host header before passing it to exec(). An attacker can exploit this by sending a maliciously crafted Host header to execute arbitrary OS commands as the web server user. The vulnerability is pre-authentication and can be triggered reliably by retrying requests.

Detection Guidance

Check if your Backpack/CRUD version is vulnerable by running: composer show backpack/crud. If the version is between 4.1.0-4.1.71, 5.0.0-5.6.1, 6.0.0-6.8.12, or 7.0.0-7.0.35, it is vulnerable. Monitor web server logs for unusual exec() calls or cURL requests with malformed Host headers.

Impact Analysis

Successful exploitation grants access to environment secrets like APP_KEY or database credentials, the filesystem, and any services the server can reach. It permits data modification or service disruption. Commands execute as the web-server user, exposing sensitive data and system access.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. It may result in data breaches, unauthorized modifications, or service disruptions, all of which are compliance violations.

Mitigation Strategies

Upgrade Backpack/CRUD to patched versions (4.1.72, 5.6.2, 6.8.13, or 7.0.36) immediately. Disable exec() in PHP if possible and validate Host headers in your web server configuration to prevent command injection.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54182. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart