backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

Summary

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest in src/Stats.php is reached from BackpackServiceProvider::boot() and constructs a shell command with a URL influenced by the HTTP Host header, which it passes to exec() without adequate shell neutralization. An unauthenticated attacker whose malformed Host value reaches PHP can inject operating-system commands when exec() and curl are available and the 1-in-100 random gate is reached. Repeated requests can reach the random gate. Successful exploitation executes commands as the web-server user, exposing environment secrets, files, and reachable services and permitting data modification or service disruption. Common reverse-proxy Host validation and hardened PHP configurations that disable exec() reduce reachability but do not correct the vulnerable construction. This issue is fixed in versions 4.1.70, 5.6.2, 6.8.13, and 7.0.36.

Timeline

1. Sep 14, 2026, 5:48 PM UTCCVE published
2. Sep 14, 2026, 6:17 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Sep 14, 2026, 6:17 PM UTCRecord last updated

Affected versions

• Laravel-Backpack CRUD

  fixed in 4.1.70; From 5.0.0 · fixed in 5.6.2; From 6.0.0 · fixed in 6.8.13; From 7.0.0 · fixed in 7.0.36

• backpack/crudPackagist

  From 4.1.0 · fixed in 4.1.72

• backpack/crudPackagist

  From 5.0.0 · fixed in 5.6.2

• backpack/crudPackagist

  From 6.0.0 · fixed in 6.8.13

• backpack/crudPackagist

  From 7.0.0 · fixed in 7.0.36

References 10