Executive brief
Laravel Backpack CRUD is a popular Laravel package that provides rapid admin panel scaffolding and database CRUD interfaces. An unauthenticated attacker can inject OS commands through a malformed HTTP Host header, achieving remote code execution as the web server user. Successful exploitation grants full access to environment files (containing database credentials and API keys), filesystem, and any services the server can reach. Exploitation requires specific environmental conditions (default web server config and enabled exec() function), but can be reliably triggered by retry.
Technical details
The vulnerability is a classic OS command injection (CWE-78) caused by improper input validation and output encoding. The Stats::makeCurlRequest method constructs a curl shell command using unescaped input sourced from the HTTP Host header, then passes the resulting string to exec(). An attacker sends a specially crafted Host header with shell metacharacters (e.g., backticks, semicolons, pipes) to break out of the intended argument and inject arbitrary commands. The code path is reached during BackpackServiceProvider::boot() on every HTTP request in production when exec() and curl are available; a 1-in-100 random probability gate is the only control, making reliable exploitation possible through retries. Attack vectors require: (1) network access to the application, (2) ability to send custom Host headers (possible unless web server strips them), and (3) exec() not disabled in the PHP environment. The fix replaces shell-based curl execution with Guzzle HTTP client, eliminating command construction entirely. Patches available in versions 4.1.72, 5.6.2, 6.8.13, and 7.0.36.
Affected products
- Laravel-Backpack CRUD 4.1.0 to < 4.1.72; 5.0.0 to < 5.6.2; 6.0.0 to < 6.8.13; 7.0.0 to < 7.0.36
Timeline
- 2026-06-15: disclosed: Initial GitHub Security Advisory published
- 2026-06-15: patched: Patches released for all maintained branches: 4.1.72, 5.6.2, 6.8.13, 7.0.36
- 2026-08-20: advisory: Advisory updated and finalized in GitHub Advisory Database