Skip to contentLaravel-backpack Crud vulnerabilities
- laravel-backpack crudbackpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelationCVE-2026-57570Fix available6.5 Medium
- laravel-backpack crudbackpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)CVE-2026-54182Fix available8.1 High
- laravel-backpack crudbackpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are invertedCVE-2026-54181Fix available5.4 Medium
- laravel-backpack crudbackpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)CVE-2026-54180Fix available7.6 High
- laravel-backpack crudbackpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public diskCVE-2026-54179Fix available4.4 Medium
- laravel-backpack crudbackpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDiskCVE-2026-54178Fix available8.1 High
- laravel-backpack crudbackpack/crud: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserverCVE-2026-54177Fix available6.6 Medium
- laravel-backpack crudbackpack/crud: MyAccountController allows changing the login email without a current-password checkCVE-2026-54176Fix available6.5 Medium
- laravel-backpack crudbackpack/crud: Unverified password change in MyAccountController via mass assignmentCVE-2026-54175Fix available7.6 High
- laravel-backpack crudbackpack/crud Vulnerable to Cross-site ScriptingCVE-2022-31114Fix available5.1 Medium