CVE-2026-54181 in CRUD
Summary
by MITRE • 09/14/2026
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, src/resources/views/crud/columns/color.blade.php inverts the escaped and raw rendering branches controlled by $column['escaped'], which defaults to true, causing $column['text'] to be rendered unescaped by default. An attacker who can store an unsanitized value in a color column can execute script in the browser of a user who views the CRUD list, including an administrator, with access to the victim's session-backed application capabilities. Exploitation requires write access to the stored color value and a victim viewing the list. This issue is fixed in versions 6.8.14 and 7.0.38.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/14/2026
The backpack/crud package serves as a foundational component for Laravel-based administration panels, providing essential Create, Read, Update, and Delete functionalities to streamline backend development. Within this ecosystem, the rendering of data columns is critical for maintaining both functionality and security integrity. A significant vulnerability was identified in versions 6.0.0 through 6.8.14 and version 7.0.38, specifically within the src/resources/views/crud/columns/color.blade.php file. This component is responsible for rendering color values selected or entered by users into the administration interface. The flaw stems from an inversion of logic in how escaped versus raw HTML content is processed based on a configuration flag named $column['escaped'].
The technical root cause lies in the incorrect handling of the escape state variable. Although the default value for $column['escaped'] is set to true, indicating that output should be sanitized and rendered as plain text rather than executable code, the conditional logic within the blade template erroneously treats this flag as false when determining which rendering branch to execute. Consequently, instead of escaping special characters such as angle brackets and quotes, the system passes user-supplied data directly into the HTML context without sanitization. This behavior effectively disables Cross-Site Scripting protections for any column configured with a color type, regardless of whether explicit security measures were intended by the developer.
This architectural flaw results in a Stored Cross-Site Scripting vulnerability that poses severe risks to administrative interfaces. An attacker who possesses write access to the application can inject malicious JavaScript payloads into fields mapped to the affected color columns. Because these values are stored in the database, they persist until manually removed or overwritten. When an administrator or any authorized user with appropriate privileges views the CRUD list containing this data, their browser executes the injected script within the context of the victim's session. This allows the attacker to perform actions on behalf of the victim, such as modifying settings, exfiltrating sensitive administrative data, or hijacking active sessions, thereby compromising the confidentiality and integrity of the entire administration panel.
The exploitation scenario requires two primary conditions: first, the attacker must have write access to a field that utilizes the vulnerable color column type, allowing them to store unsanitized input; second, a victim with sufficient privileges must view the list interface where this data is rendered. The impact extends beyond simple script execution, as it can lead to complete account takeover if session cookies are stolen or if the application lacks additional security headers like Content Security Policy that might mitigate some aspects of client-side attacks. This vulnerability aligns closely with CWE-79, which classifies improper neutralization of input during web page generation, and maps to MITRE ATT&CK techniques related to Client-Side Scripting Injection, highlighting its relevance in modern application security assessments.
To address this issue, organizations using affected versions must upgrade immediately to version 6.8.14 or later for the six series, or version 7.0.38 and above for the seven series. These releases correct the logical inversion in the blade template, ensuring that escaped content is properly sanitized before rendering. In environments where upgrading is not immediately feasible, temporary mitigations include restricting write access to color columns to trusted users only, implementing strict input validation on the server side to reject script-like payloads, and configuring Content Security Policy headers to restrict inline script execution. Regular security audits of third-party dependencies are essential to prevent similar vulnerabilities from impacting critical administrative infrastructure.