CVE-2026-54182
backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest in src/Stats.php is reached from BackpackServiceProvider::boot() and constructs a shell command with a URL influenced by the HTTP Host header, which it passes to exec() without adequate shell neutralization. An unauthenticated attacker whose malformed Host value reaches PHP can inject operating-system commands when exec() and curl are available and the 1-in-100 random gate is reached. Repeated requests can reach the random gate. Successful exploitation executes commands as the web-server user, exposing environment secrets, files, and reachable services and permitting data modification or service disruption. Common reverse-proxy Host validation and hardened PHP configurations that disable exec() reduce reachability but do not correct the vulnerable construction. This issue is fixed in versions 4.1.70, 5.6.2, 6.8.13, and 7.0.36.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | High8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Deferred | 3.1 | High8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.78% · top 44% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.1.
Weakness
- CWE-20: Improper Input Validation (opens in a new tab)All about CWE-20 and its CVEs
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (opens in a new tab)All about CWE-78 and its CVEs
- CWE-116: Improper Encoding or Escaping of Output (opens in a new tab)All about CWE-116 and its CVEs
Affected products
- affected < 4.1.70
- affected >= 5.0.0, < 5.6.2
- affected >= 6.0.0, < 6.8.13
- affected >= 7.0.0, < 7.0.36
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Packagistbackpack/crudGHSA-mrc5-3mm3-45c5 (opens in a new tab)
References (10)
- https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-mrc5-3mm3-45c5 (opens in a new tab)x_refsource_CONFIRM
- https://github.com/Laravel-Backpack/CRUD/pull/6012 (opens in a new tab)x_refsource_MISC
- https://github.com/Laravel-Backpack/CRUD/commit/0f2faafc22a15d77c14370f163d8f739f933c28c (opens in a new tab)x_refsource_MISC
- https://github.com/Laravel-Backpack/CRUD/commit/1476a3769d94a410a2d2e9576deb522e84002f2a (opens in a new tab)x_refsource_MISC
- https://github.com/Laravel-Backpack/CRUD/commit/282ba2a0b88749fb1888b3836678ba462d7023f0 (opens in a new tab)x_refsource_MISC
- https://github.com/Laravel-Backpack/CRUD/commit/471935e296b1be1a7216fdf10c8823e1f512f601 (opens in a new tab)x_refsource_MISC
- https://github.com/Laravel-Backpack/CRUD/releases/tag/4.1.72 (opens in a new tab)x_refsource_MISC
- https://github.com/Laravel-Backpack/CRUD/releases/tag/5.6.2 (opens in a new tab)x_refsource_MISC
- https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.13 (opens in a new tab)x_refsource_MISC
- https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.36 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-mrc5-3mm3-45c5 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-54182)Record last updated .