File Upload Vulnerability in Backpack CRUD for Laravel Packages
CVE-2026-54177
What is CVE-2026-54177?
An issue in Backpack CRUD exposes Laravel applications to a possible remote code execution risk due to insufficient validation of uploaded file types. Specifically, the methods 'uploadFileToDisk' and 'uploadMultipleFilesToDisk' fail to restrict server-executable file types, allowing authenticated administrators to upload malicious files when associated CRUD fields lack proper validation for mimes and mimetypes settings. This vulnerability, affecting versions 6.0.0 through 6.8.14 and 7.0.38, necessitates an update to mitigate potential exploitation risks, especially in environments where public disk access is facilitated through 'php artisan storage:link'. Remediation is available in the updated versions 6.8.14 and 7.0.38.
Affected Version(s)
CRUD >= 6.0.0, < 6.8.14 < 6.0.0, 6.8.14
CRUD >= 7.0.0, < 7.0.38 < 7.0.0, 7.0.38