Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

backpack/crud

11 known vulnerabilities (4 high, 6 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
11 · 4 high, 6 medium
Registry
Packagist

Advisories 11

  • CVE-2026-54181Medium 5.4

    backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted

    Affected: from 6.0.0, fixed in 6.8.14; from 7.0.0, fixed in 7.0.38.

  • CVE-2026-54177Medium 6.6

    backpack/crud: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver

    Affected: from 6.0.0, fixed in 6.8.14; from 7.0.0, fixed in 7.0.38.

  • CVE-2026-54176Medium 6.5

    backpack/crud: MyAccountController allows changing the login email without a current-password check

    Affected: from 6.0.0, fixed in 6.8.14; from 7.0.0, fixed in 7.0.38.

  • backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)

    Affected: from 6.0.0, fixed in 6.8.14; from 7.0.0, fixed in 7.0.38.

  • CVE-2026-57570Medium 6.5

    backpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation

    Affected: from 7.0.0, fixed in 7.0.47; from 6.0.0, fixed in 6.8.15.

  • backpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk

    Affected: from 5.0.0; from 6.0.0, fixed in 6.8.12; from 7.0.0, fixed in 7.0.35.

  • backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

    Affected: from 4.1.0, fixed in 4.1.72; from 5.0.0, fixed in 5.6.2; from 6.0.0, fixed in 6.8.13; from 7.0.0, fixed in 7.0.36.

  • backpack/crud: Unverified password change in MyAccountController via mass assignment

    Affected: fixed in 6.8.11; from 7.0.0-alpha.1, fixed in 7.0.34.

  • CVE-2026-54179Medium 4.4

    backpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk

    Affected: from 6.0.0, fixed in 6.8.14; from 7.0.0, fixed in 7.0.38.

  • CVE-2022-31114Medium 5.1

    backpack/crud Vulnerable to Cross-site Scripting

    Affected: from 5.0.0, fixed in 5.0.13; from 4.1.0, fixed in 4.1.69; fixed in 4.0.63.

  • The Backpack\CRUD Backpack component before 3.4.9 for Laravel allows XSS via the select field type.

    Affected: fixed in 3.4.9.