# CVE-2022-31114: Backpack CRUD reflected XSS in error views

Source: https://junglewise.ai/threats/cve-2022-31114-backpack-crud-reflected-xss-in-error-views  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-03. Updated: 2026-06-03  
License: CC BY 4.0 with a link back

CVE-2022-31114 · Severity: medium · CVSS 4 · Published 2026-06-03

Backpack for Laravel, a tool used to build administration panels for web applications, contains a vulnerability that could allow an attacker to execute malicious scripts in a user's browser. By tricking an administrator into clicking a specially crafted link, an attacker could potentially steal sensitive information or gain unauthorized access to the management console. This issue primarily affects the default error pages provided by the software.

Technologies: [Backpack for Laravel CRUD](https://junglewise.ai/threats/technologies/crud), [backpack/crud (Packagist)](https://junglewise.ai/threats/technologies/backpack-crud). Vendors: [Backpack for Laravel](https://junglewise.ai/threats/vendors/backpack-for-laravel), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2022-31114 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-31114 being exploited in the wild.

**How severe is CVE-2022-31114?** Medium severity, with a CVSS score of 4, published 3 June 2026.

**Which products and versions are affected?** Backpack for Laravel CRUD < 5.0.13, < 4.1.69, < 4.0.63; backpack/crud (Packagist) ECOSYSTEM:introduced=5.0.0,fixed=5.0.13.

**Is there a fix for CVE-2022-31114?** Yes. backpack/crud (Packagist): upgrade to 5.0.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-31114 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-31114?** Check whether you run Backpack for Laravel CRUD or backpack/crud (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- backpack/crud (Packagist): upgrade to 5.0.13 or later

  ```sh
  composer require backpack/crud:^5.0.13
  ```


## Technical details

A reflected cross-site scripting (XSS) vulnerability exists in the Backpack for Laravel CRUD package due to improper neutralization of input in default error views. Specifically, the software outputs exception messages without proper escaping using the `$exception->getMessage()` method instead of the secure `e()` helper. An attacker can exploit this by crafting a malicious link that triggers an exception containing a script payload. If an authenticated administrator clicks this link, the script executes in their session context, potentially allowing for session hijacking or unauthorized administrative actions. Patches are available in versions 4.0.63, 4.1.69, and 5.0.13, and users must run `php artisan backpack:fix` to update published views.

## Affected products

- Backpack for Laravel CRUD < 4.0.63, >= 4.1.0 < 4.1.69, >= 5.0.0 < 5.0.13

## Identifiers

- CVE-2022-31114
- GHSA-m8xx-3x29-84h8

## Timeline

- 2022-03: other: Vulnerability discovered by maintainers
- 2026-06-03: advisory: Public disclosure of GHSA-m8xx-3x29-84h8
- 2026-06-03: patched

## References

- [https://api.github.com/users/tabacitu](https://api.github.com/users/tabacitu)
- [https://github.com/tabacitu](https://github.com/tabacitu)
- [https://api.github.com/users/tabacitu/gists%7B/gist_id%7D](https://api.github.com/users/tabacitu/gists%7B/gist_id%7D)
- [https://api.github.com/users/tabacitu/repos](https://api.github.com/users/tabacitu/repos)
- [https://avatars.githubusercontent.com/u/1032474?v=4](https://avatars.githubusercontent.com/u/1032474?v=4)
- [https://api.github.com/users/tabacitu/events%7B/privacy%7D](https://api.github.com/users/tabacitu/events%7B/privacy%7D)

## Related threats

- [Laravel Backpack CRUD authorization bypass in HasMany/MorphMany relations](https://junglewise.ai/threats/cve-2026-57570-laravel-backpack-crud-authorization-bypass-in-hasmany-morphmany)
- [Laravel Backpack CRUD OS command injection in Stats::makeCurlRequest](https://junglewise.ai/threats/cve-2026-54182-laravel-backpack-crud-os-command-injection-in-stats)
- [Laravel Backpack CRUD stored XSS in color column](https://junglewise.ai/threats/cve-2026-54181-laravel-backpack-crud-stored-xss-in-color-column)
- [Laravel Backpack CRUD authorization bypass in write operations](https://junglewise.ai/threats/cve-2026-54180-laravel-backpack-crud-authorization-bypass-in-write-operations)
- [Laravel Backpack CRUD arbitrary file deletion in HasUploadFields](https://junglewise.ai/threats/cve-2026-54178-laravel-backpack-crud-arbitrary-file-deletion-in-hasuploadfields)