Command Injection Vulnerability in Backpack CRUD for Laravel
CVE-2026-54182
What is CVE-2026-54182?
A command injection vulnerability exists in the Backpack CRUD package for Laravel. When using versions prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, users are at risk of an attacker sending crafted HTTP Host headers that can execute arbitrary operating system commands via the exec() function. This occurs due to insufficient validation in the construction of shell commands, which are influenced by the malicious Host value. Attackers can exploit this vulnerability to gain unauthorized access to sensitive environment data, modify files, or disrupt services, particularly if exec() and curl are available on the server. Mitigations such as robust reverse-proxy host validation and disabling exec() in PHP configurations may decrease risk but do not fully address the underlying vulnerability. It is crucial for users to upgrade to the fixed versions to safeguard their applications.
Affected Version(s)
CRUD < 4.1.70 < 4.1.70
CRUD >= 5.0.0, < 5.6.2 < 5.0.0, 5.6.2
CRUD >= 6.0.0, < 6.8.13 < 6.0.0, 6.8.13