CVE-2026-54177: Laravel Backpack CRUD file upload remote code execution

CVE-2026-54177 · Severity: medium · CVSS 6.6 · Published 2026-09-14

Laravel Backpack CRUD is an administrative scaffolding library for Laravel-based web applications that handles file uploads in content management operations. An authenticated administrator with access to upload fields can bypass file-type validation and upload executable PHP files to web-accessible directories, allowing them to execute arbitrary code on the server. This requires the application to use the public storage disk and lack proper file-type validation rules.

Technologies: backpack/crud (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-54177 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54177 being exploited in the wild.
How severe is CVE-2026-54177?
Medium severity, with a CVSS score of 6.6, published 14 September 2026.
Which products and versions are affected?
backpack/crud (Packagist) ECOSYSTEM:introduced=6.0.0,fixed=6.8.14.
Is there a fix for CVE-2026-54177?
Yes. backpack/crud (Packagist): upgrade to 6.8.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54177 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54177?
Check whether you run backpack/crud (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • backpack/crud (Packagist): upgrade to 6.8.14 or later
    composer require backpack/crud:^6.8.14

Technical details

The vulnerability exists in the `HasUploadFields` trait and `FileNameGenerator` component, which hash the filename stem but preserve the client-supplied file extension without validation. The `uploadFileToDisk` and `uploadMultipleFilesToDisk` methods apply no allowlist, blocklist, or MIME-type checking to uploaded file extensions. While the newer `withFiles()` path attempts to resolve extensions from MIME types, it still does not block server-executable file types such as `.php`. An authenticated administrator accessing an upload-enabled CRUD panel can exploit this to upload a file like `shell.php` to the public storage disk; if `php artisan storage:link` has been run (standard quickstart practice) and the web server is configured to execute PHP files, the uploaded file becomes executable. Exploitation requires: authenticated admin access, an upload field without explicit `mimes:` or `mimetypes:` validation, the `public` disk in use, storage symlink in place, and a standard web server + PHP-FPM stack. Patches have been released in versions 6.8.14 and 7.0.38 that add a denylist for server-executable extensions and an allowlist for image-typed fields.

Affected products

  • Laravel Backpack CRUD 6.0.0 to 6.8.13, 7.0.0 to 7.0.37

Identifiers

  • CVE-2026-54177
  • GHSA-8q2w-pv9p-mjvc

Timeline

  • 2026-08-20: disclosed: Vulnerability published to GitHub Advisory Database
  • 2026-06-15: patched: Patches released: version 6.8.14 and 7.0.38

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.