# CVE-2026-54177: Laravel Backpack CRUD file upload remote code execution

Source: https://junglewise.ai/threats/cve-2026-54177-laravel-backpack-crud-file-upload-remote-code-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-54177 · Severity: medium · CVSS 6.6 · Published 2026-09-14

Laravel Backpack CRUD is an administrative scaffolding library for Laravel-based web applications that handles file uploads in content management operations. An authenticated administrator with access to upload fields can bypass file-type validation and upload executable PHP files to web-accessible directories, allowing them to execute arbitrary code on the server. This requires the application to use the public storage disk and lack proper file-type validation rules.

Technologies: [backpack/crud (Packagist)](https://junglewise.ai/threats/technologies/backpack-crud). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-54177 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54177 being exploited in the wild.

**How severe is CVE-2026-54177?** Medium severity, with a CVSS score of 6.6, published 14 September 2026.

**Which products and versions are affected?** backpack/crud (Packagist) ECOSYSTEM:introduced=6.0.0,fixed=6.8.14.

**Is there a fix for CVE-2026-54177?** Yes. backpack/crud (Packagist): upgrade to 6.8.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54177 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54177?** Check whether you run backpack/crud (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- backpack/crud (Packagist): upgrade to 6.8.14 or later

  ```sh
  composer require backpack/crud:^6.8.14
  ```


## Technical details

The vulnerability exists in the `HasUploadFields` trait and `FileNameGenerator` component, which hash the filename stem but preserve the client-supplied file extension without validation. The `uploadFileToDisk` and `uploadMultipleFilesToDisk` methods apply no allowlist, blocklist, or MIME-type checking to uploaded file extensions. While the newer `withFiles()` path attempts to resolve extensions from MIME types, it still does not block server-executable file types such as `.php`. An authenticated administrator accessing an upload-enabled CRUD panel can exploit this to upload a file like `shell.php` to the public storage disk; if `php artisan storage:link` has been run (standard quickstart practice) and the web server is configured to execute PHP files, the uploaded file becomes executable. Exploitation requires: authenticated admin access, an upload field without explicit `mimes:` or `mimetypes:` validation, the `public` disk in use, storage symlink in place, and a standard web server + PHP-FPM stack. Patches have been released in versions 6.8.14 and 7.0.38 that add a denylist for server-executable extensions and an allowlist for image-typed fields.

## Affected products

- Laravel Backpack CRUD 6.0.0 to 6.8.13, 7.0.0 to 7.0.37

## Identifiers

- CVE-2026-54177
- GHSA-8q2w-pv9p-mjvc

## Timeline

- 2026-08-20: disclosed: Vulnerability published to GitHub Advisory Database
- 2026-06-15: patched: Patches released: version 6.8.14 and 7.0.38

## References

- [https://api.github.com/users/therawdev](https://api.github.com/users/therawdev)
- [https://github.com/therawdev](https://github.com/therawdev)
- [https://api.github.com/users/therawdev/gists%7B/gist_id%7D](https://api.github.com/users/therawdev/gists%7B/gist_id%7D)
- [https://api.github.com/users/therawdev/repos](https://api.github.com/users/therawdev/repos)
- [https://avatars.githubusercontent.com/u/74800891?v=4](https://avatars.githubusercontent.com/u/74800891?v=4)
- [https://api.github.com/users/therawdev/events%7B/privacy%7D](https://api.github.com/users/therawdev/events%7B/privacy%7D)

## Related threats

- [Laravel Backpack CRUD authorization bypass in HasMany/MorphMany relations](https://junglewise.ai/threats/cve-2026-57570-laravel-backpack-crud-authorization-bypass-in-hasmany-morphmany)
- [Laravel Backpack CRUD OS command injection in Stats::makeCurlRequest](https://junglewise.ai/threats/cve-2026-54182-laravel-backpack-crud-os-command-injection-in-stats)
- [Laravel Backpack CRUD stored XSS in color column](https://junglewise.ai/threats/cve-2026-54181-laravel-backpack-crud-stored-xss-in-color-column)
- [Laravel Backpack CRUD authorization bypass in write operations](https://junglewise.ai/threats/cve-2026-54180-laravel-backpack-crud-authorization-bypass-in-write-operations)
- [Laravel Backpack CRUD arbitrary file deletion in HasUploadFields](https://junglewise.ai/threats/cve-2026-54178-laravel-backpack-crud-arbitrary-file-deletion-in-hasuploadfields)