CVE-2026-54179

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/SingleBase64Image.php methods SingleBase64Image::uploadFiles and SingleBase64Image::uploadRepeatableFiles, used by image fields through withFiles(), accept any data URI beginning with data:image without validating the declared MIME subtype or decoded bytes, while src/app/Library/Uploaders/Support/FileNameGenerator.php method FileNameGenerator::getExtensionFromFile applies mime_content_type() to the data URI instead of the decoded content. An authenticated administrator can therefore store arbitrary file content under an extensionless filename on the configured disk, which can cause stored cross-site scripting or other unintended behavior when the file is served and accessed. This issue is fixed in version 7.0.38 and 6.8.14.

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/SingleBase64Image.php methods SingleBase64Image::uploadFiles and SingleBase64Image::uploadRepeatableFiles, used by image fields through withFiles(), accept any data URI beginning with data:image without validating the declared MIME subtype or decoded bytes, while src/app/Library/Uploaders/Support/FileNameGenerator.php method FileNameGenerator::getExtensionFromFile applies mime_content_type() to the data URI instead of the decoded content. An authenticated administrator can therefore store arbitrary file content under an extensionless filename on the configured disk, which can cause stored cross-site scripting or other unintended behavior when the file is served and accessed. This issue is fixed in version 7.0.38 and 6.8.14.

Summary

SingleBase64Image::uploadFiles — the uploader bound to image-typed fields via withFiles() — only verifies that the submitted value starts with the string data:image. The MIME subtype and the base64-decoded bytes are never inspected or validated. A related bug in FileNameGenerator causes the stored file to receive an extensionless filename, because mime_content_type() returns false when given a data URI instead of a filesystem path.

The combination allows an authenticated admin to store a file of arbitrary type on the configured disk under a name without a recognizable extension.

Details

// src/app/Library/Uploaders/SingleBase64Image.php
if (Str::startsWith($value, 'data:image')) {
    // MIME subtype and decoded bytes are not validated
    $base64Image = Str::after($value, ';base64,');
    $finalPath   = $this->getPath() . $this->getFileName($value);
    Storage::disk($this->getDisk())->put($finalPath, base64_decode($base64Image));
    return $finalPath;
}

// src/app/Library/Uploaders/Support/FileNameGenerator.php
private function getExtensionFromFile(string|UploadedFile $file): string
{
    return is_a($file, UploadedFile::class, true)
        ? $file->extension()
        : Str::after(mime_content_type($file), '/'); // returns false on data URIs → empty string
}

The stored filename ends with a trailing dot and no extension.

Impact

An authenticated admin submitting a malicious payload to a Backpack image field stored with withFiles() can write arbitrary file content to the configured storage disk. Depending on server configuration and how stored files are served, this may lead to stored XSS or other unintended behavior when the file is later accessed.

Fix

The fix validates the declared MIME subtype against an allowlist, decodes the base64 payload, and verifies the actual file bytes with finfo before storing. The extension is derived from the detected MIME type rather than the data URI string. Applied in SingleBase64Image::uploadFiles and uploadRepeatableFiles; FileNameGenerator::getExtensionFromFile now rejects inputs that produce an empty extension.

Setting X-Content-Type-Options: nosniff on admin responses is a useful defense-in-depth complement.

Affected versions

• >= 6.0.0, < 6.8.14
• >= 7.0.0, < 7.0.38

Patched versions

• 6.8.14
• 7.0.38

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/SingleBase64Image.php methods SingleBase64Image::uploadFiles and SingleBase64Image::uploadRepeatableFiles, used by image fields through withFiles(), accept any data URI beginning with data:image without validating the declared MIME subtype or decoded bytes, while src/app/Library/Uploaders/Support/FileNameGenerator.php method FileNameGenerator::getExtensionFromFile applies mime_content_type() to the data URI instead of the decoded content. An authenticated administrator can therefore store arbitrary file content under an extensionless filename on the configured disk, which can cause stored cross-site scripting or other unintended behavior when the file is served and accessed. This issue is fixed in version 7.0.38 and 6.8.14.

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/SingleBase64Image.php methods SingleBase64Image::uploadFiles and SingleBase64Image::uploadRepeatableFiles, used by image fields through withFiles(), accept any data URI beginning with data:image without validating the declared MIME subtype or decoded bytes, while src/app/Library/Uploaders/Support/FileNameGenerator.php method FileNameGenerator::getExtensionFromFile applies mime_content_type() to the data URI instead of the decoded content. An authenticated administrator can therefore store arbitrary file content under an extensionless filename on the configured disk, which can cause stored cross-site scripting or other unintended behavior when the file is served and accessed. This issue is fixed in version 7.0.38 and 6.8.14.

Summary

SingleBase64Image::uploadFiles — the uploader bound to image-typed fields via withFiles() — only verifies that the submitted value starts with the string data:image. The MIME subtype and the base64-decoded bytes are never inspected or validated. A related bug in FileNameGenerator causes the stored file to receive an extensionless filename, because mime_content_type() returns false when given a data URI instead of a filesystem path.

The combination allows an authenticated admin to store a file of arbitrary type on the configured disk under a name without a recognizable extension.

Details

// src/app/Library/Uploaders/SingleBase64Image.php
if (Str::startsWith($value, 'data:image')) {
    // MIME subtype and decoded bytes are not validated
    $base64Image = Str::after($value, ';base64,');
    $finalPath   = $this->getPath() . $this->getFileName($value);
    Storage::disk($this->getDisk())->put($finalPath, base64_decode($base64Image));
    return $finalPath;
}

// src/app/Library/Uploaders/Support/FileNameGenerator.php
private function getExtensionFromFile(string|UploadedFile $file): string
{
    return is_a($file, UploadedFile::class, true)
        ? $file->extension()
        : Str::after(mime_content_type($file), '/'); // returns false on data URIs → empty string
}

The stored filename ends with a trailing dot and no extension.

Impact

An authenticated admin submitting a malicious payload to a Backpack image field stored with withFiles() can write arbitrary file content to the configured storage disk. Depending on server configuration and how stored files are served, this may lead to stored XSS or other unintended behavior when the file is later accessed.

Fix

The fix validates the declared MIME subtype against an allowlist, decodes the base64 payload, and verifies the actual file bytes with finfo before storing. The extension is derived from the detected MIME type rather than the data URI string. Applied in SingleBase64Image::uploadFiles and uploadRepeatableFiles; FileNameGenerator::getExtensionFromFile now rejects inputs that produce an empty extension.

Setting X-Content-Type-Options: nosniff on admin responses is a useful defense-in-depth complement.

Affected versions

• >= 6.0.0, < 6.8.14
• >= 7.0.0, < 7.0.38

Patched versions

• 6.8.14
• 7.0.38