# CVE-2026-54182: Laravel Backpack CRUD OS command injection in Stats::makeCurlRequest

Source: https://junglewise.ai/threats/cve-2026-54182-laravel-backpack-crud-os-command-injection-in-stats  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-54182 · Severity: high · CVSS 8.1 · Published 2026-09-14

Laravel Backpack CRUD is a popular Laravel package that provides rapid admin panel scaffolding and database CRUD interfaces. An unauthenticated attacker can inject OS commands through a malformed HTTP Host header, achieving remote code execution as the web server user. Successful exploitation grants full access to environment files (containing database credentials and API keys), filesystem, and any services the server can reach. Exploitation requires specific environmental conditions (default web server config and enabled exec() function), but can be reliably triggered by retry.

Technologies: [backpack/crud (Packagist)](https://junglewise.ai/threats/technologies/backpack-crud). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-54182 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54182 being exploited in the wild.

**How severe is CVE-2026-54182?** High severity, with a CVSS score of 8.1, published 14 September 2026.

**Which products and versions are affected?** backpack/crud (Packagist) ECOSYSTEM:introduced=4.1.0,fixed=4.1.72.

**Is there a fix for CVE-2026-54182?** Yes. backpack/crud (Packagist): upgrade to 4.1.72 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54182 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54182?** Check whether you run backpack/crud (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- backpack/crud (Packagist): upgrade to 4.1.72 or later

  ```sh
  composer require backpack/crud:^4.1.72
  ```


## Technical details

The vulnerability is a classic OS command injection (CWE-78) caused by improper input validation and output encoding. The Stats::makeCurlRequest method constructs a curl shell command using unescaped input sourced from the HTTP Host header, then passes the resulting string to exec(). An attacker sends a specially crafted Host header with shell metacharacters (e.g., backticks, semicolons, pipes) to break out of the intended argument and inject arbitrary commands. The code path is reached during BackpackServiceProvider::boot() on every HTTP request in production when exec() and curl are available; a 1-in-100 random probability gate is the only control, making reliable exploitation possible through retries. Attack vectors require: (1) network access to the application, (2) ability to send custom Host headers (possible unless web server strips them), and (3) exec() not disabled in the PHP environment. The fix replaces shell-based curl execution with Guzzle HTTP client, eliminating command construction entirely. Patches available in versions 4.1.72, 5.6.2, 6.8.13, and 7.0.36.

## Affected products

- Laravel-Backpack CRUD 4.1.0 to < 4.1.72; 5.0.0 to < 5.6.2; 6.0.0 to < 6.8.13; 7.0.0 to < 7.0.36

## Identifiers

- CVE-2026-54182
- GHSA-mrc5-3mm3-45c5

## Timeline

- 2026-06-15: disclosed: Initial GitHub Security Advisory published
- 2026-06-15: patched: Patches released for all maintained branches: 4.1.72, 5.6.2, 6.8.13, 7.0.36
- 2026-08-20: advisory: Advisory updated and finalized in GitHub Advisory Database

## References

- [https://api.github.com/users/therawdev](https://api.github.com/users/therawdev)
- [https://github.com/therawdev](https://github.com/therawdev)
- [https://api.github.com/users/therawdev/gists%7B/gist_id%7D](https://api.github.com/users/therawdev/gists%7B/gist_id%7D)
- [https://api.github.com/users/therawdev/repos](https://api.github.com/users/therawdev/repos)
- [https://avatars.githubusercontent.com/u/74800891?v=4](https://avatars.githubusercontent.com/u/74800891?v=4)
- [https://api.github.com/users/therawdev/events%7B/privacy%7D](https://api.github.com/users/therawdev/events%7B/privacy%7D)

## Related threats

- [Laravel Backpack CRUD authorization bypass in HasMany/MorphMany relations](https://junglewise.ai/threats/cve-2026-57570-laravel-backpack-crud-authorization-bypass-in-hasmany-morphmany)
- [Laravel Backpack CRUD stored XSS in color column](https://junglewise.ai/threats/cve-2026-54181-laravel-backpack-crud-stored-xss-in-color-column)
- [Laravel Backpack CRUD authorization bypass in write operations](https://junglewise.ai/threats/cve-2026-54180-laravel-backpack-crud-authorization-bypass-in-write-operations)
- [Laravel Backpack CRUD arbitrary file deletion in HasUploadFields](https://junglewise.ai/threats/cve-2026-54178-laravel-backpack-crud-arbitrary-file-deletion-in-hasuploadfields)
- [Laravel Backpack CRUD file upload remote code execution](https://junglewise.ai/threats/cve-2026-54177-laravel-backpack-crud-file-upload-remote-code-execution)