Executive brief
Laravel Backpack CRUD is an administrative scaffolding library for Laravel-based web applications that handles file uploads in content management operations. An authenticated administrator with access to upload fields can bypass file-type validation and upload executable PHP files to web-accessible directories, allowing them to execute arbitrary code on the server. This requires the application to use the public storage disk and lack proper file-type validation rules.
Technical details
The vulnerability exists in the `HasUploadFields` trait and `FileNameGenerator` component, which hash the filename stem but preserve the client-supplied file extension without validation. The `uploadFileToDisk` and `uploadMultipleFilesToDisk` methods apply no allowlist, blocklist, or MIME-type checking to uploaded file extensions. While the newer `withFiles()` path attempts to resolve extensions from MIME types, it still does not block server-executable file types such as `.php`. An authenticated administrator accessing an upload-enabled CRUD panel can exploit this to upload a file like `shell.php` to the public storage disk; if `php artisan storage:link` has been run (standard quickstart practice) and the web server is configured to execute PHP files, the uploaded file becomes executable. Exploitation requires: authenticated admin access, an upload field without explicit `mimes:` or `mimetypes:` validation, the `public` disk in use, storage symlink in place, and a standard web server + PHP-FPM stack. Patches have been released in versions 6.8.14 and 7.0.38 that add a denylist for server-executable extensions and an allowlist for image-typed fields.
Affected products
- Laravel Backpack CRUD 6.0.0 to 6.8.13, 7.0.0 to 7.0.37
Timeline
- 2026-08-20: disclosed: Vulnerability published to GitHub Advisory Database
- 2026-06-15: patched: Patches released: version 6.8.14 and 7.0.38