Stored Cross-Site Scripting Vulnerability in Backpack by Laravel
CVE-2026-54179
4.4MEDIUM
What is CVE-2026-54179?
The Backpack CRUD package, utilized for creating custom administration panels in Laravel, is susceptible to a vulnerability where the methods SingleBase64Image::uploadFiles and SingleBase64Image::uploadRepeatableFiles do not validate the MIME subtype or data content of uploaded images. This oversight allows authenticated administrators to upload arbitrary file contents with extensionless filenames, leading to potential stored cross-site scripting attacks and other unintended behaviors when the files are served. Vulnerable versions include 6.0.0 through 6.8.14 and 7.0.37, while the issue is mitigated in versions 6.8.14 and 7.0.38.
Affected Version(s)
CRUD >= 6.0.0, < 6.8.14 < 6.0.0, 6.8.14
CRUD >= 7.0.0, < 7.0.38 < 7.0.0, 7.0.38