Executive brief
Backpack for Laravel, a tool used to build administration panels for web applications, contains a vulnerability that could allow an attacker to execute malicious scripts in a user's browser. By tricking an administrator into clicking a specially crafted link, an attacker could potentially steal sensitive information or gain unauthorized access to the management console. This issue primarily affects the default error pages provided by the software.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in the Backpack for Laravel CRUD package due to improper neutralization of input in default error views. Specifically, the software outputs exception messages without proper escaping using the `$exception->getMessage()` method instead of the secure `e()` helper. An attacker can exploit this by crafting a malicious link that triggers an exception containing a script payload. If an authenticated administrator clicks this link, the script executes in their session context, potentially allowing for session hijacking or unauthorized administrative actions. Patches are available in versions 4.0.63, 4.1.69, and 5.0.13, and users must run `php artisan backpack:fix` to update published views.
Affected products
- Backpack for Laravel CRUD < 4.0.63, >= 4.1.0 < 4.1.69, >= 5.0.0 < 5.0.13
Timeline
- 2022-03: other: Vulnerability discovered by maintainers
- 2026-06-03: advisory: Public disclosure of GHSA-m8xx-3x29-84h8
- 2026-06-03: patched