# CVE-2026-54179: Laravel Backpack CRUD arbitrary file upload via base64 image field

Source: https://junglewise.ai/threats/cve-2026-54179-laravel-backpack-crud-arbitrary-file-upload-via-base64-image  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-54179 · Severity: medium · CVSS 4.4 · Published 2026-08-31

Laravel Backpack CRUD's image upload field accepts any file type disguised as base64 data with a `data:image` prefix, allowing authenticated admins to store malicious files like SVG scripts on the public disk. If the stored files are served to users' browsers, this can lead to stored cross-site scripting (XSS) attacks or file execution depending on server configuration.

Technologies: [backpack/crud (Packagist)](https://junglewise.ai/threats/technologies/backpack-crud). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-54179 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54179 being exploited in the wild.

**How severe is CVE-2026-54179?** Medium severity, with a CVSS score of 4.4, published 31 August 2026.

**Which products and versions are affected?** backpack/crud (Packagist) ECOSYSTEM:introduced=6.0.0,fixed=6.8.14.

**Is there a fix for CVE-2026-54179?** Yes. backpack/crud (Packagist): upgrade to 6.8.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54179 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54179?** Check whether you run backpack/crud (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- backpack/crud (Packagist): upgrade to 6.8.14 or later

  ```sh
  composer require backpack/crud:^6.8.14
  ```


## Technical details

The vulnerability exists in `SingleBase64Image::uploadFiles`, which only validates that the submitted value starts with the string `data:image` but does not inspect the MIME subtype or verify the base64-decoded bytes. Additionally, `FileNameGenerator::getExtensionFromFile` fails to generate a file extension when given a data URI (since `mime_content_type()` returns false), resulting in files stored with extensionless names. An authenticated admin can exploit this to upload arbitrary file types (e.g., SVG with embedded scripts) to the configured storage disk. The fix validates MIME subtypes against an allowlist, verifies decoded bytes with `finfo`, derives extensions from detected MIME types rather than data URI strings, and rejects inputs producing empty extensions. The vulnerability requires authentication and user interaction, affecting versions 6.0.0–6.8.13 and 7.0.0–7.0.37.

## Affected products

- Laravel Backpack CRUD 6.0.0 to 6.8.13, 7.0.0 to 7.0.37

## Identifiers

- CVE-2026-54179
- GHSA-8hw4-7qjr-3wxg

## Timeline

- 2026-08-20: disclosed: Published to GitHub Advisory Database
- 2026-08-20: patched: Fixed in versions 6.8.14 and 7.0.38

## References

- [https://api.github.com/users/pxpm](https://api.github.com/users/pxpm)
- [https://github.com/pxpm](https://github.com/pxpm)
- [https://api.github.com/users/pxpm/gists%7B/gist_id%7D](https://api.github.com/users/pxpm/gists%7B/gist_id%7D)
- [https://api.github.com/users/pxpm/repos](https://api.github.com/users/pxpm/repos)
- [https://avatars.githubusercontent.com/u/7188159?v=4](https://avatars.githubusercontent.com/u/7188159?v=4)
- [https://api.github.com/users/pxpm/events%7B/privacy%7D](https://api.github.com/users/pxpm/events%7B/privacy%7D)

## Related threats

- [Laravel Backpack CRUD authorization bypass in HasMany/MorphMany relations](https://junglewise.ai/threats/cve-2026-57570-laravel-backpack-crud-authorization-bypass-in-hasmany-morphmany)
- [Laravel Backpack CRUD OS command injection in Stats::makeCurlRequest](https://junglewise.ai/threats/cve-2026-54182-laravel-backpack-crud-os-command-injection-in-stats)
- [Laravel Backpack CRUD stored XSS in color column](https://junglewise.ai/threats/cve-2026-54181-laravel-backpack-crud-stored-xss-in-color-column)
- [Laravel Backpack CRUD authorization bypass in write operations](https://junglewise.ai/threats/cve-2026-54180-laravel-backpack-crud-authorization-bypass-in-write-operations)
- [Laravel Backpack CRUD arbitrary file deletion in HasUploadFields](https://junglewise.ai/threats/cve-2026-54178-laravel-backpack-crud-arbitrary-file-deletion-in-hasuploadfields)