Laravel-Backpack vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 202610

Newest CVEs

• CVE-2026-54181

  backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted

  Laravel-Backpack · CRUD

  Medium5.4
• CVE-2026-54177

  backpack/crud: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver

  Laravel-Backpack · CRUD

  Medium6.6
• CVE-2026-54176

  backpack/crud: MyAccountController allows changing the login email without a current-password check

  Laravel-Backpack · CRUD

  Medium6.5
• CVE-2026-54180

  backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)

  Laravel-Backpack · CRUD

  High7.6
• CVE-2026-57570

  backpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation

  Laravel-Backpack · CRUD

  Medium6.5
• CVE-2026-54178

  backpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk

  Laravel-Backpack · CRUD

  High8.1
• CVE-2026-54182

  backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

  Laravel-Backpack · CRUD

  High8.1
• CVE-2026-54175

  backpack/crud: Unverified password change in MyAccountController via mass assignment

  Laravel-Backpack · CRUD

  High7.6
• CVE-2026-54179

  backpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk

  Laravel-Backpack · CRUD

  Medium4.4
• CVE-2022-31114

  backpack/crud Vulnerable to Cross-site Scripting

  Laravel-Backpack · CRUD

  Medium5.1