CVE-2026-54182 in CRUD
Summary
by MITRE • 09/14/2026
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest in src/Stats.php is reached from BackpackServiceProvider::boot() and constructs a shell command with a URL influenced by the HTTP Host header, which it passes to exec() without adequate shell neutralization. An unauthenticated attacker whose malformed Host value reaches PHP can inject operating-system commands when exec() and curl are available and the 1-in-100 random gate is reached. Repeated requests can reach the random gate. Successful exploitation executes commands as the web-server user, exposing environment secrets, files, and reachable services and permitting data modification or service disruption. Common reverse-proxy Host validation and hardened PHP configurations that disable exec() reduce reachability but do not correct the vulnerable construction. This issue is fixed in versions 4.1.70, 5.6.2, 6.8.13, and 7.0.36.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified within Backpack\CRUD affects multiple major release lines including version series 4.1 prior to 4.1.70, 5.6 prior to 5.6.2, 6.8 prior to 6.8.13, and 7.0 prior to 7.0.36. This library serves as a core component for Laravel-based administration panels, providing essential Create, Read, Update, and Delete functionalities. The security flaw resides specifically within the Stats module, where the makeCurlRequest method in src/Stats.php is invoked during the booting phase of the BackpackServiceProvider. Under normal operational conditions, this function is intended to gather statistical data by making HTTP requests; however, the implementation fails to properly sanitize input derived from the HTTP Host header before using it in system-level command execution.
The technical root cause is classified as OS Command Injection, aligning with CWE-78 and CWE-501 regarding insufficiently trusted data consumption. The vulnerability arises because the application constructs a shell command string that incorporates values influenced by the incoming HTTP Host header. This unsanitized input is then passed directly to PHP's exec function alongside curl for execution. Because the Host header is user-controllable via standard HTTP requests, an attacker can inject arbitrary operating system commands into this pipeline. The exploitation mechanism relies on a probabilistic gate within the code that triggers with approximately one-in-one-hundred probability per request. While this randomization might seem to mitigate risk by limiting immediate exploitability, it does not prevent successful attacks when combined with automated tools capable of sending repeated requests until the condition is met.
From an operational impact perspective, successful exploitation allows an unauthenticated attacker to execute commands with the privileges of the web server process. This level of access poses severe risks including unauthorized disclosure of environment secrets such as database credentials or API keys, reading sensitive files stored on the server filesystem, and interacting with internal services that are reachable from the application's network context. Furthermore, the ability to modify data or disrupt services undermines the integrity and availability guarantees provided by the administration panel. The attack vector is remote and unauthenticated, making it particularly dangerous in publicly accessible environments where reverse proxies may not strictly validate Host headers against expected domain names.
Mitigation strategies must address both immediate remediation and long-term defense-in-depth measures. The primary corrective action is to upgrade Backpack\CRUD to version 4.1.70 or later for the 4.x branch, 5.6.2 or later for the 5.x branch, 6.8.13 or later for the 6.x branch, and 7.0.36 or later for the 7.x branch. These versions contain patches that properly neutralize shell metacharacters in user-supplied input before command construction. Additionally, organizations should enforce strict Host header validation at the reverse proxy level to ensure only expected domain names are processed by the application backend. Hardening PHP configurations by disabling dangerous functions like exec() where they are not strictly required can also reduce the attack surface, although this is a compensating control rather than a fix for the underlying code flaw. Monitoring logs for unusual patterns of requests targeting statistical endpoints may help detect attempted exploitation in real-time.