Is CVE-2026-54181 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54181 being exploited in the wild.

How severe is CVE-2026-54181?

Medium severity, with a CVSS score of 5.4, published 14 September 2026.

Which products and versions are affected?

backpack/crud (Packagist) ECOSYSTEM:introduced=6.0.0,fixed=6.8.14.

Is there a fix for CVE-2026-54181?

Yes. backpack/crud (Packagist): upgrade to 6.8.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54181 attacked?

It is attacked over the network.

Am I affected by CVE-2026-54181?

Check whether you run backpack/crud (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54181: Laravel Backpack CRUD stored XSS in color column

CVE-2026-54181 · Severity: medium · CVSS 5.4 · Published 2026-09-14

Laravel Backpack CRUD is a popular administration panel builder for Laravel web applications. A bug in the color column display template renders user-supplied color values without HTML escaping by default, allowing an attacker who can inject a malicious value into a color column to execute arbitrary JavaScript in the browsers of anyone viewing the list—including administrators. This enables stealing session cookies, CSRF tokens, and other sensitive data.

Technologies: backpack/crud (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-54181 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54181 being exploited in the wild.
How severe is CVE-2026-54181?: Medium severity, with a CVSS score of 5.4, published 14 September 2026.
Which products and versions are affected?: backpack/crud (Packagist) ECOSYSTEM:introduced=6.0.0,fixed=6.8.14.
Is there a fix for CVE-2026-54181?: Yes. backpack/crud (Packagist): upgrade to 6.8.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54181 attacked?: It is attacked over the network.
Am I affected by CVE-2026-54181?: Check whether you run backpack/crud (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

backpack/crud (Packagist): upgrade to 6.8.14 or later
```
composer require backpack/crud:^6.8.14
```

Technical details

The vulnerability is a stored XSS (CWE-79) caused by inverted conditional logic in the color column Blade template (src/resources/views/crud/columns/color.blade.php). While all other column templates in the library follow the pattern of using {{ }} (HTML-escaped) when $column['escaped'] is true and {!! !!} (raw output) when false, the color template has these branches reversed. Because $column['escaped'] defaults to true, color values are rendered unescaped by default, enabling stored XSS. The attack requires write access to a color-typed column (low privilege requirement) and is triggered when a victim views the list (user interaction required). Scope change occurs because injected JavaScript executes in the context of the victim's session, not the attacker's. The fix corrects the branch order in color.blade.php; patched versions are 6.8.14 and 7.0.38.

Affected products

Laravel Backpack CRUD 6.0.0 through 6.8.13; 7.0.0 through 7.0.37

Identifiers

CVE-2026-54181
GHSA-mmg4-322v-6jvc

Timeline

2026-06-15: disclosed: Published to GitHub Advisory Database
2026-06-15: patched: Fixed in versions 6.8.14 and 7.0.38 (PR #5992)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.