Executive brief
Laravel Backpack CRUD's image upload field accepts any file type disguised as base64 data with a `data:image` prefix, allowing authenticated admins to store malicious files like SVG scripts on the public disk. If the stored files are served to users' browsers, this can lead to stored cross-site scripting (XSS) attacks or file execution depending on server configuration.
Technical details
The vulnerability exists in `SingleBase64Image::uploadFiles`, which only validates that the submitted value starts with the string `data:image` but does not inspect the MIME subtype or verify the base64-decoded bytes. Additionally, `FileNameGenerator::getExtensionFromFile` fails to generate a file extension when given a data URI (since `mime_content_type()` returns false), resulting in files stored with extensionless names. An authenticated admin can exploit this to upload arbitrary file types (e.g., SVG with embedded scripts) to the configured storage disk. The fix validates MIME subtypes against an allowlist, verifies decoded bytes with `finfo`, derives extensions from detected MIME types rather than data URI strings, and rejects inputs producing empty extensions. The vulnerability requires authentication and user interaction, affecting versions 6.0.0–6.8.13 and 7.0.0–7.0.37.
Affected products
- Laravel Backpack CRUD 6.0.0 to 6.8.13, 7.0.0 to 7.0.37
Timeline
- 2026-08-20: disclosed: Published to GitHub Advisory Database
- 2026-08-20: patched: Fixed in versions 6.8.14 and 7.0.38