Cross-Site Scripting Threat in Backpack CRUD for Laravel
CVE-2026-54181
What is CVE-2026-54181?
The Backpack CRUD package for Laravel allows users to build custom administration panels, offering comprehensive Create, Read, Update, and Delete (CRUD) functionalities. However, from versions 6.0.0 to 6.8.14 and 7.0.38, a flaw exists in the color rendering logic of the system. Specifically, the handling of the $column['escaped'] variable can lead to unsanitized inputs being rendered as raw HTML. This vulnerability permits an attacker who can manipulate the stored color value to introduce malicious scripts. When an administrator—or any user—views the affected CRUD list, these scripts can be executed in their browsers, potentially compromising session security and user data. To mitigate this issue, it is crucial to upgrade to at least versions 6.8.14 or 7.0.38.
Affected Version(s)
CRUD >= 6.0.0, < 6.8.14 < 6.0.0, 6.8.14
CRUD >= 7.0.0, < 7.0.38 < 7.0.0, 7.0.38