CVE-2026-54177 in CRUD
Summary
by MITRE • 09/14/2026
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, HasUploadFields methods uploadFileToDisk and uploadMultipleFilesToDisk, used through CrudTrait, and the withFiles() path through FileNameGenerator do not internally reject server-executable file types. An authenticated administrator can achieve remote code execution by using an upload-enabled CRUD field without mimes: and mimetypes: validation when the public disk is web-accessible through php artisan storage:link and the web-server and PHP-FPM configuration executes the stored extension. The legacy path preserves an accepted extension and the newer path derives an extension without blocking dangerous types. The package-level restriction is defense in depth and does not replace application-level upload validation. This issue is fixed in versions 6.8.14 and 7.0.38.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/14/2026
The backpack/crud package, a widely used collection of Laravel packages designed to facilitate the creation of custom administration panels, contains a critical security vulnerability affecting file upload functionality across specific version ranges. Versions from 6.0.0 up to and including 6.8.14, as well as versions 7.0.38 and earlier in that branch, are susceptible to this flaw. The core issue resides within the HasUploadFields trait methods specifically named uploadFileToDisk and uploadMultipleFilesToDisk, which are invoked through CrudTrait, as well as the withFiles path utilized by FileNameGenerator. These components are responsible for handling file uploads from administrative interfaces but fail to implement adequate server-side validation regarding executable file types. This deficiency allows an attacker who has obtained authenticated administrator credentials to bypass standard security controls and upload malicious scripts that can be executed on the target system, leading directly to remote code execution.
The technical mechanism of this vulnerability relies on the absence of mandatory MIME type or extension filtering within the package itself when specific validation configurations are omitted by the application developer. When an admin user interacts with a CRUD field configured for file uploads but lacking explicit mimes: and mimetypes: validation rules, the system accepts files regardless of their content or intended purpose. The legacy code path preserves the original file extension provided by the client without checking if it corresponds to a dangerous type such as PHP scripts. Similarly, the newer implementation derives an extension from the uploaded data but does not block extensions associated with server-side execution environments. This lack of internal rejection for executable types means that if the application's public disk is web-accessible via commands like php artisan storage:link and the underlying web-server or PHP-FPM configuration is set to execute files based on their extension, any uploaded script will run in the context of the web service user.
The operational impact of this vulnerability is severe, as it enables an authenticated attacker to achieve full remote code execution on the server hosting the Laravel application. By uploading a malicious file with an executable extension such as .php and ensuring it resides in a publicly accessible directory, the attacker can trigger arbitrary command execution through web requests. This compromise allows for data exfiltration, persistence mechanisms, lateral movement within the network, or complete system takeover depending on the privileges of the web server process. The vulnerability highlights that package-level restrictions serve only as defense-in-depth measures and should never be relied upon exclusively to secure file uploads; application developers must implement robust validation at the application level regardless of the underlying library's default behaviors.
To mitigate this risk, organizations using affected versions of backpack/crud must upgrade immediately to version 6.8.14 or 7.0.38 where these flaws have been addressed by enforcing stricter checks on uploaded file types. In addition to upgrading, developers should ensure that all upload-enabled CRUD fields include explicit mimes: and mimetypes: validation rules in their Laravel form requests or field configurations to reject executable extensions such as php, phtml, phar, and others depending on the server configuration. It is also critical to verify that storage directories are not directly web-accessible unless absolutely necessary, and if they must be linked via symbolic links, proper access controls should restrict direct execution of files within those paths. This incident aligns with CWE-434 which describes the unrestricted upload of file types, a common flaw in web applications where insufficient validation allows attackers to introduce harmful content into trusted systems. Furthermore, this exploitation technique maps to MITRE ATT&CK techniques related to Initial Access via Valid Accounts and Execution through Web Shell deployment, emphasizing the need for rigorous input validation and least-privilege configurations in administrative interfaces.