Backpack CRUD
by Laravel
CVEs (5)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-54182 | hig | 0.38 | — | — | Aug 20, 2026 | ## Summary `Backpack\CRUD\Stats::makeCurlRequest` builds a shell command using unescaped input that originates from the HTTP `Host` header, then passes it to `exec()`. A specially crafted Host header can break out of the shell argument and cause the server to execute arbitrary… | ||
| CVE-2026-54180 | hig | 0.38 | — | — | Aug 20, 2026 | ## Summary Backpack CRUD's list and read operations correctly apply any query scopes registered via `addClause()` / `addBaseClause()` (e.g. tenant isolation, user ownership). However, the **Update**, **Delete**, and **Reorder** operations bypassed these scopes, fetching records… | ||
| CVE-2026-54178 | hig | 0.38 | — | — | Aug 20, 2026 | ## Summary `HasUploadFields::uploadMultipleFilesToDisk` (in `src/app/Models/Traits/HasUploadFields.php`) reads file paths from the `clear_[]` request input and deletes them from the configured storage disk **without verifying that the paths belong to the current… | ||
| CVE-2026-57570 | 0.00 | — | — | Aug 20, 2026 | ## Vulnerability Details Affected area: HasMany / MorphMany relation handling during CRUD create and update operations CWE: CWE-862 — Missing Authorization Severity: Medium CVSS: 6.5 — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N ### Summary Backpack CRUD contained… | |||
| CVE-2026-54179 | 0.00 | — | — | Aug 20, 2026 | ### Summary `SingleBase64Image::uploadFiles` — the uploader bound to `image`-typed fields via `withFiles()` — only verifies that the submitted value starts with the string `data:image`. The MIME subtype and the base64-decoded bytes are never inspected or validated. A… |
- risk 0.38cvss —epss —
## Summary `Backpack\CRUD\Stats::makeCurlRequest` builds a shell command using unescaped input that originates from the HTTP `Host` header, then passes it to `exec()`. A specially crafted Host header can break out of the shell argument and cause the server to execute arbitrary…
- risk 0.38cvss —epss —
## Summary Backpack CRUD's list and read operations correctly apply any query scopes registered via `addClause()` / `addBaseClause()` (e.g. tenant isolation, user ownership). However, the **Update**, **Delete**, and **Reorder** operations bypassed these scopes, fetching records…
- risk 0.38cvss —epss —
## Summary `HasUploadFields::uploadMultipleFilesToDisk` (in `src/app/Models/Traits/HasUploadFields.php`) reads file paths from the `clear_[]` request input and deletes them from the configured storage disk **without verifying that the paths belong to the current…
- CVE-2026-57570Aug 20, 2026risk 0.00cvss —epss —
## Vulnerability Details Affected area: HasMany / MorphMany relation handling during CRUD create and update operations CWE: CWE-862 — Missing Authorization Severity: Medium CVSS: 6.5 — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N ### Summary Backpack CRUD contained…
- CVE-2026-54179Aug 20, 2026risk 0.00cvss —epss —
### Summary `SingleBase64Image::uploadFiles` — the uploader bound to `image`-typed fields via `withFiles()` — only verifies that the submitted value starts with the string `data:image`. The MIME subtype and the base64-decoded bytes are never inspected or validated. A…